Main goal is to let in everyone's agents (OpenClaw, Hermes...) without human intervention, while keeping out deterministic scripts farming API keys.

If a few tool-wielding humans slip through, that's fine (traditional CAPTCHAs also let in our stealth agents)