fix(auth): retain session across pre-refresh discovery outages

[adrianwebb]

Outcome

Do not erase a valid encrypted session when API/issuer discovery fails before renewal submits a refresh token.

Work authority

• Work item / Issue: Fixes Preserve authenticated sessions when discovery fails before token refresh #193
• Proposal / decision: Repair local acceptance interruption under Platform #501.
• Assignment / checkpoint: Session renewal reliability.
• Actor: adrianwebb
• Human authority: adrianwebb
• Agent / capacity provider: Codex under human authority
• Exact base ref: 3127d76
• Exact head ref: 251a50e
• Agent-authored under human authority

Plan

Keep discovery and renewal within the serialized session transaction. Begin failure invalidation only immediately before refresh invocation.

Changes and commits

251a50e introduces a transaction invalidation predicate. Unavailable discovery preserves the session and team. Ambiguous refresh continues to clear the selected session. No alternate credential storage or authentication bypass.

Verification

Three synthetic resource/issuer/refresh outage tests pass; all four existing custody tests passed in the preceding focused run. Strict TypeScript and file architecture pass. CLI distribution rebuilt without touching unrelated generated docs/schema edits. Actions required on exact head.

Risk and rollback

Session invalidation behavior is deliberately unchanged once refresh begins, including uncertain token rotation. Revert this commit to restore prior behavior. Already-erased credentials are not recovered; browser sign-in remains required.

Completion summary

The identified pre-refresh outage defect is fixed. This does not assert successful live source-enabled agent execution.

Submission checklist

• The change is bounded to the stated work item and target repository.
• Exact base and head refs are recorded and the branch is ready for review.
• Verification and compatibility evidence are recorded above.
• No plaintext secrets, credentials, machine state, or unrelated residue are included.
• Plan, status, commits, and completion summary form a complete durable record.
• Rollback or recovery steps are documented and executable.