Qualify Copilot and Kimi device auth methods

[piclaw-bot]

Public Copilot/Kimi device-flow matrix

Refs #1458 and #1442; both stay open.

• Exercise public exact-0.99.1 OAuth owners through synthetic provider-specific endpoints/prompts/events, with implementation/shared-poller fingerprints.
• Cover 11 cases per provider: pending success, denial, malformed device/token, blocked-fetch cancellation, real expiry, server slow-down, unsafe URI and initial/pending/slow-down timer cancellation.
• Check bounded real cadence and prompt aborts; Copilot token/catalog reads permit no model-policy writes. No credential persistence or inference.
• Archive separately executed Bun/real Node receipts. Regular CI re-executes Bun and checks archive consistency; it does not claim Node reruns.

Package-method scope only: no SDK/CLI/UI/live-account, enterprise matrix or policy/Delegate acceptance. Fetch interception is not an OS sandbox. Severe scheduling delay fails timing bounds rather than being silently accepted.

Validation

22 cases passed Bun 1.4.2 and Node 26.7.0. Matrix/Codex regular set: 2 pass / 31 assertions. Five types, strict test types, scoped lint, diff and independent rereview pass. Post-atomic-merge matrix/Codex set passed again at2/31. Canonical: 5,970 passed, eight existing/opt-in skips, zero failed; 25 feature and nine web checks passed. Pack hygiene: 24,742 files. Final five types/diff passed at baseline 50f0538ab; unchanged compose baseline. Private Bun cache, shared-cache permissions unchanged.