feat(sdk): let a credential provider perform the OAuth refresh grant itself

Executor performed the OAuth refresh exchange itself, so it had to ask the
credential provider for the stored refresh token and the client secret, which
a sealed store cannot hand over. CredentialProvider gains an optional
refreshGrant: the provider spends the refresh token, seals the new tokens under
the same item ids and returns only lifetime and scope, which the host
re-validates. Providers without it, client_credentials grants and first-party
apps keep the existing host path unchanged.

Author: GeiserX

.changeset/provider-owned-oauth-refresh-grant.md

@@ -0,0 +1,7 @@
+---
+"@executor-js/sdk": minor
+---
+
+`CredentialProvider` gains an optional `refreshGrant`. When a provider implements it, Executor asks it to perform the OAuth refresh exchange instead of asking it for the refresh token: the provider spends the token, seals the newly minted access token (and a rotated refresh token, if the authorization server sent one) under the same item ids, and reports only the granted lifetime and scope. Executor re-validates that metadata, reads the access token back through `get` like any other credential, and never resolves the refresh token or the client secret on that path.
+
+A refused grant comes back as `RefreshGrantRejected` carrying a closed standards-defined token-endpoint code, so a delegated refusal classifies re-authentication, surfaces `invalid_grant` to the caller, and arms the known-dead gate exactly as a host-side refusal does. Providers that do not implement `refreshGrant` are unaffected, and so are the grants that have no refresh token to delegate.

packages/core/sdk/src/executor.ts

@@ -109,7 +109,18 @@ export type {
 } from "./connection";
 export type { Tool, ToolDef, ToolListFilter, ToolAnnotations } from "./tool";
 // Credential providers.
-export type { CredentialProvider, ProviderEntry } from "./provider";
+export {
+  MAX_REFRESH_GRANT_EXPIRES_IN_SECONDS,
+  RefreshGrantRejected,
+  isRefreshGrantRejectionCode,
+} from "./provider";
+export type {
+  CredentialProvider,
+  ProviderEntry,
+  RefreshGrantInput,
+  RefreshGrantRejectionCode,
+  RefreshGrantResult,
+} from "./provider";
 
 // Public projections / detection.
 export { ToolSchemaView, ToolAnnotationsView, IntegrationDetectionResult } from "./types";