Disable browser cookie fallback for local X auth

Prefer injected AUTH_TOKEN/CT0 for bundled Bird, disable browser-cookie probing in repo-invoked subprocesses, and keep repo-invoked yt-dlp from inheriting browser-cookie settings.

Validation: uv run python -m unittest tests.test_bird_x tests.test_youtube_yt

scripts/lib/bird_x.py

@@ -36,10 +36,19 @@ def set_credentials(auth_token: Optional[str], ct0: Optional[str]):
         _credentials['CT0'] = ct0
 
 
+def _has_injected_credentials() -> bool:
+    """Return True when both X session cookies were injected from config."""
+    return bool(_credentials.get('AUTH_TOKEN') and _credentials.get('CT0'))
+
+
 def _subprocess_env() -> Dict[str, str]:
     """Build env dict for Node subprocesses, merging injected credentials."""
     env = os.environ.copy()
     env.update(_credentials)
+    # When repo config already provides cookies, disable browser-cookie fallback
+    # so vendored Bird never hits Safari/Chrome keychain during automation.
+    if _has_injected_credentials():
+        env.setdefault("BIRD_DISABLE_BROWSER_COOKIES", "1")
     return env
 
 
@@ -126,6 +135,9 @@ def is_bird_authenticated() -> Optional[str]:
     if not is_bird_installed():
         return None
 
+    if _has_injected_credentials():
+        return "env AUTH_TOKEN"
+
     try:
         result = subprocess.run(
             ["node", str(_BIRD_SEARCH_MJS), "--whoami"],
@@ -473,4 +485,4 @@ def parse_bird_response(response: Dict[str, Any]) -> List[Dict[str, Any]]:
 
         items.append(item)
 
-    return items
+    return items