Closes issue #44 (Metal Gear's feedback, 2026-10-11).
flow rootfs push needed $OXY_TOKEN though oh auth login had saved a login for that hub on the same machine. With no OXY_TOKEN, push and pull now take the token and CA from Oxygen's credential store (oxy_core::credentials, what oh and oxy use), and the hub from --hub, OH_HUB or the runner's config. With none: 'no token for HUB: sign in with oh auth login --hub HUB, or set OXY_TOKEN'.
Checked by hand: with OXY_TOKEN unset, flow rootfs pull <unknown> --hub https://oxygenhub.io signed in with the saved login (the hub answered 'does not hold image', not 401). Gate green (54 tests, clippy, fmt). Bookmark is main's heads plus this change.