Replace Ambiguous AI setup with agent signup flow

[sofiasanchez985]

Replaces the body of the Ambiguous AI section in using-sponsor-tools.md, starting at "Access and authentication..." The section heading is unchanged, so the #ambiguous-ai anchor that README.md, dev-docs/sponsors.md, and apps/web/README.md link to still resolves.

What the section says now

• New to Ambiguous? → ambiguous.ai, select Invite your agent.
• Already signed up? → Admin, select New agent.
• A pasteable prompt for an agent with terminal access that provisions a new workspace via npx ambiguous@latest auth signup, verifies with npx ambiguous whoami, and pulls the operating guide from https://app.ambiguous.ai/skill.

One thing to decide before merging

The replaced text was the only place documenting AMBIGUOUS_API_KEY — the root .env variable the web template actually reads. It is still referenced by .env.example, dev-docs/troubleshooting.md, and code in apps/web and packages/agent-core:

• apps/web/src/lib/server/workplace.ts
• apps/web/scripts/check-workplace.ts
• packages/agent-core/src/capabilities/workplace.ts

Most visibly, apps/web/README.md line 22 says "Configure root .env with OpenAI and Ambiguous AI" and links to this exact anchor — which no longer explains the key. Also gone: the identity-check first call, and the guidance on the MCP write boundary and 401 vs 403.

The new signup flow issues a CLI credential, which is a different thing from the AMBIGUOUS_API_KEY the web template expects, so builders following the web template may be left without the variable they need. Happy to add a short Configure block back under the new content, or wire apps/web/README.md to a different anchor — say which you prefer and I will push it.

🤖 Generated with Claude Code

[sofiasanchez985]

Restored the AMBIGUOUS_API_KEY configure block at the end of the section, so the gap flagged above is closed:

• **Configure** root .env for the web template: with the AMBIGUOUS_API_KEY=your-workspace-api-key dotenv block
• A follow-up line on where the key comes from, that the kit sends it as a Bearer credential to https://app.ambiguous.ai/mcp, that the vendor CLI manages its own credentials separately, and the 401 vs 403 distinction

Verified the variable name matches .env.example and the code in apps/web/src/lib/server/workplace.ts and packages/agent-core/src/capabilities/workplace.ts. The apps/web/README.md link to #ambiguous-ai now lands on a section that explains the key again.

Still not restored from the original text, since the new flow covers the setup path: the identity-check first call (/api/users/me), the web template create/read-back walkthrough, and the MCP write-boundary paragraph. Say the word if any of those should come back too.