#25759 Preserve macOS sessions after refresh rejection or Keychain read failure

Summary

Supersedes #25665 and carries its auth-session persistence fix onto current main.

• Classify refresh-token 400/401 responses: a rejection naming the refresh token (REFRESH_TOKEN_NOT_FOUND_OR_EXPIRED, REFRESH_TOKEN_ERROR, PROVIDER_REJECTED, invalid_grant) or naming no error clears the session; a named client rejection or a non-JSON page keeps it, with a cancellation-aware cooldown.
• Reset refresh cooldown state when the active refresh-token session changes.
• Treat only temporary Keychain read failures (locked or busy: errSecInteractionNotAllowed, errSecNotAvailable, on the current or legacy account) as unavailable during restore, preserving the cached session. A permanent failure reads as an empty store, so a session with no usable token still routes to sign-in after the file fallback is checked.
• Remove unrelated test-registry entries and keep the auth regression tests deterministic.

The original PR branch rejects force updates after the required rebase, so this follow-up contains the rebased, review-complete head.

Testing

• python3 scripts/verify-local.py --only swift-syntax --swift-changed
• python3 scripts/verify-local.py --only test-wiring
• git diff --check
• Remote controller build and hosted auth-refresh/package tests are being run for this exact head.

Changelog

Fixed: preserve signed-in macOS sessions when refresh requests or Keychain reads fail for reasons unrelated to the session.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

Summary by CodeRabbit

• Bug Fixes
  • Refresh requests rejected for request or client errors no longer automatically end the session; saved tokens are retained, and repeat attempts are briefly paused.
  • Errors that indicate an expired or invalid session still clear the session.
  • When token storage is temporarily unavailable, the app preserves the cached authenticated session instead of clearing it.