Anthropic OAuth LLM, entitlements (feature 1), renewals, + 7 enhancements

- LLM: Anthropic Sonnet 5 (effort=low) via OAuth Bearer (Claude Code keychain
  token, expiry-aware); NVIDIA/LM Studio endpoints kept commented for switch-back.
- Entitlements: scripts/import_entitlements.py joins ACL export to accounts by
  normalized parent name (324/342 matched; ID column Excel-corrupted), maps
  products->capabilities via data/product_capability_map.json. Raw ACL csv and
  entitlements.json are gitignored (confidential); accounts.json carries derived
  currentProducts + ownedCapabilityIds. Owned capabilities tag briefs EXPANSION.
- Renewals: local renewal-proximity score boost (window 365d, max +0.10) +
  'renewals' report; briefs/digests show RENEWAL WINDOW context.
- Batch runs: loop --limit/--rep with persistent cursor (strategic + stale-first).
- Digests: per-rep HTML export; timestamped digest_<date>_<time>.md kept forever.
- Account narrative memory fed into relevance/synthesis; synthesis maintains it.
- Signal quality gate drops PR fluff pre-LLM; SEC EDGAR filings connector.
- Citation verification: talking points must cite [S#] signals or are dropped.
- Brief filenames use account-name slug; whitespace report + installed-base view.
- USAGE.md: full command/flag/env reference.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

sales-agent/data/product_capability_map.json

@@ -0,0 +1,48 @@
+{
+  "_note": "Maps entitlement product taxonomy (Product BU / Family / Midfamily / Subfamily substrings, case-insensitive regex) to capability ids. Matching runs LOCALLY in scripts/import_entitlements.py — no LLM. Families that match nothing are logged to output/state/entitlement_unmapped.json; extend this map from that log.",
+  "patterns": [
+    {"match": "VSAN",                          "capability": "cap_vmw_vsan"},
+    {"match": "VSPHERE|VVS|VVEP|ESXI",         "capability": "cap_vmw_vsphere"},
+    {"match": "\\bVCF\\b|CLOUD FOUNDATION",     "capability": "cap_vmw_vcf"},
+    {"match": "NSX|VDEFEND",                   "capability": "cap_vmw_nsx"},
+    {"match": "\\bAVI\\b|LOAD BALANC",          "capability": "cap_vmw_avi"},
+    {"match": "ARIA|VREALIZE|VCF OPS|OPERATIONS MGMT", "capability": "cap_vmw_aria"},
+    {"match": "TANZU|KUBERNETES",              "capability": "cap_vmw_tanzu"},
+    {"match": "WORKSPACE ONE|WS1|AIRWATCH",    "capability": "cap_vmw_workspaceone"},
+    {"match": "HORIZON",                       "capability": "cap_vmw_horizon"},
+    {"match": "SITE RECOVERY|LIVE RECOVERY|SRM|RANSOMWARE", "capability": "cap_vmw_live_recovery"},
+    {"match": "\\bHCX\\b",                      "capability": "cap_vmw_hcx"},
+    {"match": "PRIVATE AI",                    "capability": "cap_vmw_private_ai"},
+
+    {"match": "ENDEVOR",                       "capability": "cap_mf_endevor"},
+    {"match": "BRIGHTSIDE|ZOWE",               "capability": "cap_mf_brightside"},
+    {"match": "\\bIDMS\\b",                     "capability": "cap_mf_idms"},
+    {"match": "DATACOM",                       "capability": "cap_mf_datacom"},
+    {"match": "DB2",                           "capability": "cap_mf_db2tools"},
+    {"match": "TOP SECRET|ACF2|ACF-2",         "capability": "cap_mf_security"},
+    {"match": "COMPLIANCE EVENT|DATA CONTENT DISCOVERY|CLEANUP", "capability": "cap_mf_compliance"},
+    {"match": "OPS/MVS|OPSMVS",                "capability": "cap_mf_automation"},
+    {"match": "SYSVIEW",                       "capability": "cap_mf_sysview"},
+    {"match": "MAINFRAME OPERATIONAL INTELLIGENCE|\\bMOI\\b", "capability": "cap_mf_aiops"},
+    {"match": "CA 7|CA7|CA-7",                 "capability": "cap_mf_workload_automation"},
+    {"match": "NETMASTER",                     "capability": "cap_mf_network"},
+    {"match": "VANTAGE|DISK BACKUP",           "capability": "cap_mf_storage"},
+
+    {"match": "RALLY|AGILE CENTRAL",           "capability": "cap_es_rally"},
+    {"match": "CLARITY|PPM",                   "capability": "cap_es_clarity"},
+    {"match": "VALUEOPS|CONNECTALL",           "capability": "cap_es_valueops_insights"},
+    {"match": "\\bAPM\\b|APP.*PERFORMANCE|INTROSCOPE|WILY", "capability": "cap_es_dx_apm"},
+    {"match": "DX OPERATIONAL|DX AIOPS|DX O2", "capability": "cap_es_dx_aiops"},
+    {"match": "NETOPS|SPECTRUM|PERFORMANCE MGMT.*NET", "capability": "cap_es_dx_netops"},
+    {"match": "APPNETA",                       "capability": "cap_es_appneta"},
+    {"match": "AUTOMIC|AUTOSYS|WORKLOAD AUTOMATION", "capability": "cap_es_automation"},
+    {"match": "LAYER ?7|API MANAGEMENT|API GATEWAY", "capability": "cap_es_layer7"},
+
+    {"match": "SITEMINDER|ACCESS MANAGEMENT|\\bSSO\\b", "capability": "cap_iam_siteminder"},
+    {"match": "\\bVIP\\b.*AUTH|SYMANTEC VIP",  "capability": "cap_iam_vip"},
+    {"match": "\\bPAM\\b|PRIVILEGED",           "capability": "cap_iam_pam"},
+    {"match": "IDENTITY (GOVERNANCE|SUITE|MANAGER)|\\bIGA\\b", "capability": "cap_iam_iga"},
+    {"match": "DIRECTORY",                     "capability": "cap_iam_directory"},
+    {"match": "ADVANCED AUTH|AUTH HUB",        "capability": "cap_iam_advauth"}
+  ]
+}