fix(auth): harden Claude OAuth credential pools

[eddieparc]

Summary

• preserve provider-owned OAuth account pools instead of double-appending their flat compatibility credential
• recognize concrete OAuth credentials selected by shared credential rotation
• keep synthetic managed sentinels excluded from readiness checks
• classify OAuth refresh DNS, connection, timeout, socket, and fetch failures as temporary provider errors
• retain persistent account blocking for invalid_grant, invalid_token, revoked tokens, HTTP 401, and unauthorized responses

Root causes

1. The shared login layer appended the Claude provider's already-complete account pool a second time, creating a fake slot from its managed sentinel.
2. The managed auth lane wrapped every token-refresh exception as authentication_failed, so a DNS outage permanently blocked a valid account until re-login.

Verification

• transient/auth classification regression: 5 cases passed
• Claude OAuth regression suite: 5 files, 50 tests passed
• credential pool regression: 5 tests passed
• TypeScript, Biome, full monorepo build, browser smoke, and repository pre-commit checks passed
• Anthropic DNS and HTTPS probes passed 3/3 after the outage
• expired-token refresh succeeded and three consecutive live claude-sdk-oauth requests passed with fallback disabled

[eddieparc]

Cross-reference: Linear OLI-281 (https://linear.app/oliveline/issue/OLI-281/senpi-claude-sdk-oauth-provider-%EB%9D%BC%EC%9A%B0%ED%8C%85%EC%9C%BC%EB%A1%9C-OMO-%EC%84%B8%EC%85%98-%EC%9E%AC%EA%B0%9C-%EC%8B%A4%ED%8C%A8), GitHub issue #1261 (#1261). Real Orca QA on resumed session 01a05add-8e0c-7918-b2c8-551e0298a50d returned RESUME_OK without a new provider-configuration error using claude-sdk-oauth/claude-opus-5:high.

[code-yeongyu]

Cross-reference: #1309 (merged as 10f58c0) landed the slots.ts provider-owned pool guard and the oauth-login.ts projected-slot readiness fix with credit to @eddieparc, and #1312 carries the transient-refresh classification (ENOTFOUND/ECONNRESET/... -> retryable, invalid_grant/401 -> auth_error) from this PR's errors.ts hunk, also credited. Once #1312 merges the production changes here will all be on main; the host-runtime/rpc hunks in this PR are unrelated to those two fixes and would need their own rebase.

[code-yeongyu]

Closing as superseded — thank you @eddieparc, the production fixes here are on main with credit to this PR.

• fix(auth): keep provider-owned Claude OAuth pools intact on login #1309 (10f58c073) landed the appendLoginSlot provider-owned pool guard in packages/ai/src/auth/pool/slots.ts and the oauth-login.ts configuredFor projected-slot count. Same hunks as this PR; tracker even names fix(auth): harden Claude OAuth credential pools #1196.
• fix(claude-sdk-oauth): surface SDK error text and classify is_error results #1312 (221e64067) landed the transient-refresh classification in errors.ts (ENOTFOUND/ECONNRESET/ETIMEDOUT/UND_ERR_* / fetch failed / connection reset by peer → retryable other; invalid_grant/401 → auth_error) and the auth-lane.ts mapping of those refresh failures to server_error: instead of a persistent authentication_failed.

The leftover interactive-host-runtime.ts / host-ensure.ts / session-event-writer.ts hunks (and their tests) are unrelated to claude-sdk-oauth: biome wrapping plus a redundant switchSession({ withSession }) assertion. That formatting is already on main (082d71bff); the writer logic was extracted to session-event-fanout.ts and superseded by #1277 (02dc16cfa), #1280 (6259ee4c7), and #1296 (e2174be51). Nothing left here is worth a 392-commit rebase.