Qualify public Anthropic and OpenRouter browser OAuth

[piclaw-bot]

Qualify Anthropic/OpenRouter public browser and manual methods

Twenty synthetic OAuth cases execute separately under Bun1.4.2 and real Node26.7.0 using public provider factories from exact Earendil0.99.1.

Coverage

• Manual/callback success, invalid callback then success, callback/token denial, malformed JSON, prompt/exchange cancellation and pre-abort.
• Anthropic manual state mismatch and OpenRouter missing key.
• Exact PKCE/request payloads, token/key fields, Anthropic refresh rotation and OpenRouter non-expiring refresh semantics.
• Active exact IPv4-loopback bind, real owned callback HTTP/no-store responses, manual-prompt abort, transport abort, and port release.
• Mandatory distinct loopback-only netns, no capabilities/groups/elevation, pre-import fetch guard, no unsandboxed fallback.
• Frozen separate-runtime receipts; ordinary CI validates reviewed hashes, outcomes and refusal outside a namespace. Opt-in suite freshly runs Bun only.

Validation

• Fresh serial namespace executions: 20/20 each on Bun1.4.2 and Node26.7.0.
• Focused executable/receipt/refusal: 3 tests / 214 assertions.
• Scoped typing/lint/diff and independent review pass.
• Canonical gate: 5,990 passed / 8 existing or opt-in skips / 0 failures, plus 25 feature tests and 9 web checks. Namespace executions ran separately.
• Pack hygiene: 24,743 files. Five typechecks pass; compose retains 95 unchanged baseline diagnostics. Private Bun cache, no shared-cache permission changes.

Scope and failures

Public provider methods only. Full packaged CLI/Piclaw UI, actual provider websites, Radius/xAI/Meta, malformed Anthropic token-field semantics, exhaustive callback races, persistence/live tokens, external traces, Delegate and native MCP acceptance remain unqualified. No inference/deployment/restart; #1442/#1458 stay open.

Initial fetch-only preflights excluded from final OS-isolated qualification. A Node supplementary-group assertion failed due to its getgroups effective-GID behaviour; kernel Groups verification corrected it. Review gaps in guard ordering/deadlines/preabort/portownership/bind/hash proofs fixed and re-reviewed.

Refs #1458.