feat: integrate GitHub Copilot OAuth alongside OpenAI Codex - #36

…-copilot-v1

Wire the merged github-copilot provider through the harness and codework so
both providers share one credential store, one contract and one presentation.

harness
- Resolve stored OAuth credentials for both providers behind one `authFile`
  option, and route Copilot to the plan-specific host recorded at login.
- Pair that host with the credential it was issued for; an environment token
  may be another account and would 401 against it.
- Put the auth-file rule on `Global.authFile` so the harness and the RPC
  server cannot disagree about where a login lives.

codework
- Replace the four codex-specific RPCs with `auth.save/status/refresh/logout`
  carrying a provider, and store both providers from one service.
- Give `auth` subcommands -- login, status, refresh, logout -- matching the
  rest of the CLI. Login-only options no longer appear on the read commands,
  and two validation rules become unrepresentable rather than enforced.
- Drop --originator, --print-headers and --manual: no user behind the first
  two, and --device covers everything the third did without a port.

aikit
- Refuse to rewrite an auth.json that could not be read. A write rebuilds the
  whole file, so treating an unreadable one as empty dropped every other
  provider's credentials on the next login.
- Resolve a Copilot token from COPILOT_GITHUB_TOKEN or auth.json and nothing
  else. GITHUB_TOKEN/GH_TOKEN are usually set for git and carry no Copilot
  access, and a credential another application stored for itself should not
  silently become the identity a run bills and acts as.
- Bind the port and path the Codex redirect URI names rather than a second
  hardcoded copy, and report a failed bind instead of dropping to an
  unexplained paste prompt.
- Add Codex device-code login, which needs no local port at all.
- Share device-code polling, the browser/prompt helpers and credential
  presentation, so both CLIs report a login identically.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>