Use provider credentials and add offline OIDC/MCP access

[aaltshuler]

Replace managed device/refresh brokerage with direct AuthKit public-client login and refresh through the official WorkOS Rust SDK. Rotating credentials stay in the OS keychain, with coordinated refresh, an eight-hour absolute sign-in limit and a durable pending marker for uncertain exchanges. Before a graph request, the CLI obtains a missing or expired identity-only credential without replaying a submitted operation.

Activate bounded managed load and commit-list/show commands using the transport from #685. Ordinary explicit addressing remains unchanged. This uses the existing narrow managed selection rules; it does not depend on or implement #675's proposed named-connection resolver.

Add optional offline OIDC verification and read-only MCP using the maintained Rust MCP SDK. Public trust binds the issuer, audience, organization, subject-to-principal admissions, cluster incarnation and root. Applied Cedar remains the graph permission authority. Admission snapshots expire after at most 300 seconds; reloading them does not restart the writer. MCP exposes minimal graph discovery, stored-read listing and complete bounded stored-read results.

Compatibility and cleanup:

• Provider-native login requires a compatible authentication-profile endpoint and fresh sign-in for old opaque sessions; the obsolete broker and its cache are removed.
• Published version-1 restricted credentials remain explicitly supported without automatic authority widening. Direct/static access remains supported.
• Removed obsolete broker-renewal documentation and an unused direct dependency. Transport code is inherited once from the parent stack.
• This adds no stored graph format change and does not deploy OAuth clients or public routing.

Wire the existing CI, GQT and DST checks to merge-queue commits. Queue runs use full qualification and the same pre-merge gates; publishing, credentials and branch-protection settings remain unchanged.

This builds on the merged identity-policy change in #691. The accepted contract is recorded in docs/rfcs/2026-09-09-identity-credentials-and-applied-policy.md; user-facing changes are in upcoming v0.12 notes.

Validation: formatting, documentation/link checks, locked dependency resolution and diff checks pass. Canonical local workspace/failpoint tests pass (3,216 passed, 25 ignored), as do 149 GQT library and 14 runner-dispatch tests. These include authentication, OIDC/MCP and 104 OpenAPI tests. Existing OpenAPI schemas/routes are preserved apart from the additive OAuth metadata route. The upstream required-parameter GQT fixture also passes locally. Full workspace, GQ, DST, Clippy, server AWS, both RustFS suites and storage format/upgrade CI pass on the application tree. Queue wiring passes actionlint, existing workflow guards, documentation checks and exercises of both classifiers with an empty PR payload; merge-group runs execute the same pre-merge qualification. Provider interoperability evidence is separate from deployment qualification.