Integrate Agent hosted handoff and isolated Research Dev desktop

[AnthonyRonning]

Agent Dev needs a browser return path that opens the correct client, and Research needs a separate desktop installation for Auth Dev rehearsal. This adds both consumers using the Auth Dev foundation merged in #1103.

• Agent Dev starts the existing SDK native handoff on auth-dev.maple.ai. A short-lived listener bound to 127.0.0.1 accepts only its state and prepared handoff target, redeems once, and closes on completion, cancellation, replacement or timeout. Auth mints the grant before showing an explicit return link. Production Agent retains its current OAuth flow until a later pilot.
• Research Dev has its own macOS bundle, storage and callback scheme, fixed Dev endpoints, and no production updater. Add an unsigned build script and PR artifact job; preserve production Research, web sign-in, the SDK pin and existing iOS Dev origin selection.
• Allow unprivileged validation workflows to run against stacked PR bases. Signing and publication gates are unchanged.

Runner prerequisite #1113 is merged. This PR is refreshed onto master 0d7e4e2b at 79d62d0a; the complete source tree is byte-identical to the previously validated 61b9afeb tree, and all four commits are patch-identical. The additional Research Dev Mac job also uses ARM64 macos-26. The auth implementation was rebased onto current master without behavioral changes: the only conflict combined the existing AuthSite and newly merged Apple fixture counts.

The PR does not edit live provider/backend settings or DNS, distribute a client release, or switch production traffic. Relevant Auth master changes and internal PR previews use the established Dev publisher; production Auth publication remains manual.

Validation at 61b9afeb:

• 124 Auth tests, formatting, lint and typechecking passed using the existing pinned toolchain.
• 432 repository hook tests passed, plus focused Research Dev profile, Xcode selection and Agent workflow checks, actionlint and diff checks.
• Range-diff confirms the original three implementation commits are preserved apart from updated Apple fixture context; the additional commit changes only the Research Dev runner label.
• Fresh hosted checks are running on the rebased commit. The prior hosted run and cache comparisons are linked in ci: unblock auth rollout validation with standard runners #1113; a Git history refresh does not establish additional runtime evidence. Local native builds were not repeated because of VM disk constraints.

After hosted checks complete, use the new Dev artifacts for Agent/Research browser-return rehearsal. Prior source, unit and build evidence does not establish the new artifacts' live OAuth behavior.

[github-actions]

Maple Auth development preview: https://7d00ceb9.maple-auth-dev.pages.dev

Commit: 79d62d0ae14b43b79dd079988aa0098cac24fb58

Uses development services. Cloudflare Access applies. Provider OAuth is not configured for PR URLs; use the stable Auth Dev host for OAuth rehearsal.

[github-actions]

Maple development preview: https://526b64f4.maple-ca8.pages.dev

Commit: 79d62d0ae14b43b79dd079988aa0098cac24fb58

Uses development API, billing, flags and PCR configuration. Cloudflare Access applies.