Update native ChatGPT authentication for the app-server-owned callback flow

[lynnswap]

Parent: #96
Related: #97

Contract

The recovery branch must keep native ephemeral web presentation while following the current Codex app-server login lifecycle. The app-server owns its localhost callback and login completion; ReviewMonitor only presents the authorization URL and observes the stock completion/account state.

Acceptance criteria

• ASWebAuthenticationSession is only the presentation owner and does not intercept the app-server localhost callback.
• ReviewMonitor does not send the retired account/login/complete request.
• Ephemeral browser configuration is set before start().
• Missing anchor, inability to start, and presentation-context failure have one explicit external-browser fallback.
• User cancellation maps to account/login/cancel(loginId).
• Stock login notification plus account read is the only success owner.
• Authentication tasks have one cancellation/close owner and no callback after teardown.
• Real login, cancel, fallback, restart, and account-selection flows are verified.
• API key authentication remains isolated in Reintroduce API key authentication on the v0.6.2 recovery architecture #97.

Historical evidence

The base contains an older native-login contract. Current behavior is represented by PR #80 and the final ephemeral fix in PR #95 (195e542, merged as 26c8f7b).

[lynnswap]

Design-gate clarification: ChatGPT browser login also runs in an isolated staging Codex home/app-server. ASWebAuthenticationSession remains presentation-only; app-server owns localhost callback/completion. After authoritative staging account read, the opaque auth artifact is atomically adopted. signIn activates only after adoption; addAccount preserves the current shared active account/runtime until explicit selection. Cancel/close awaits the staging runtime and prevents callbacks after teardown.

[lynnswap]

The ChatGPT recovery design is now implementation-gated at local checkpoint bd7af4b with zero remaining design blockers. Saved identity is a generated internal UUID (email is nullable presentation metadata), LoginSession waits for matching completion then the post-reload account/updated + account/read, finite grace falls back to a same-home fresh read, and app-server owns the localhost callback. Sign-in produces a candidate only; the Wave 3 runtime owner quiesces the old runtime/lease before creating and applying the crash-atomic activation journal. Add-account never changes active/shared runtime state. Implementation remains sequenced after reviewed Wave 4D.

[lynnswap]

Sequencing update: the current ChatGPT login lifecycle will be implemented in Wave 5 on top of descriptor capability core #113 and throwing runtime close #106. Bare staging URLs and log-only cleanup failure are rejected; LoginStagingLease must own acquisition, runtime/client/writer completion, typed close, and cleanup debt.