Support pre-minted session tokens

[bc-anam]

Summary

• restore Python SDK sessions authenticated with a pre-minted session token
• keep the token snapshot authoritative by sending only SDK metadata at session start
• preserve the legacy positional-token constructor while recommending session_token=
• add the standard low-risk/hot-fix auto-approval workflow

Testing

• uv run pytest -q (68 passed)
• uv run ruff check src tests
• uv run mypy src still reports the 31 pre-existing aiortc/PyAV typing errors in _signalling.py, _streaming.py, and _user_audio_input_track.py; no errors remain in changed files

---

Summary by cubic

Add pre-minted session token auth to the Python SDK so sessions can start without an API key. Fix token-auth message sending and retain API-key persona validation; the token snapshot stays authoritative and only client metadata is sent at start.

• New Features

  • AnamClient supports session_token=; provide exactly one of api_key or session_token. Tokens cannot be combined with persona_id or persona_config. Legacy positional token (JWT with dots) still works.
  • CoreApiClient.start_session switches auth mode; token path sends only clientMetadata and uses the token in Authorization.
  • README includes a token example. CI adds auto-approve for low-risk/hot-fix PRs; bootstrap-safe.

• Migration

  • Use AnamClient(session_token="...") when a trusted service pre-minted the token.
  • Do not pass persona_id, persona_config, client label, routing overrides, or session options to override a token snapshot.
  • With an api_key, continue to provide either persona_id or persona_config (not both).

^{Written for commit b0cbbb4. Summary will update on new commits.}

[anam-push-bot]

Auto-approved with label(s): low-risk

[cubic-dev-ai]

All reported issues were addressed across 1 file (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

1 issue found across 3 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/anam/client.py">

<violation number="1" location="src/anam/client.py:579">
P3: `_get_persona_config` is now dead code: this change removed its only caller in `send_message`, and nothing else references it. Either keep using it for the API-key path or delete the method to avoid misleading private API surface.</violation>
</file>

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Fix all with cubic | Re-trigger cubic</sub>