Fix OAuth2 code token exchange

[chubes4]

Summary

• Include the OAuth authorization code in token exchange requests handled by OAuth2Handler::handle_callback().
• Unblocks PKCE / authorization-code providers that do not use implicit fragment callbacks.

Testing

• homeboy lint data-machine --path /Users/chubes/Developer/data-machine@fix-oauth2-code-token-exchange --file inc/Core/OAuth/OAuth2Handler.php
• Deployed to intelligence-horse and verified WP.com PKCE flow reaches the code callback path.

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode (GPT-5.5)
• Used for: Diagnosing the OAuth callback/token exchange path, drafting the fix, and running local/remote verification commands.

[homeboy-ci]

Homeboy Results — data-machine

Lint

✅ lint — passed

ℹ️ Full options: homeboy docs commands/lint
Deep dive: homeboy lint data-machine --changed-since b51839d

Test

✅ test — passed

ℹ️ No impacted tests found for --changed-since b51839d
ℹ️ Run full suite if needed: homeboy test data-machine
Deep dive: homeboy test data-machine --changed-since b51839d

Audit

✅ audit — passed

• requested_detectors — 134 finding(s)
• test_coverage — 33 finding(s)
• intra-method-duplication — 8 finding(s)
• dead_code — 4 finding(s)
• dead_guard — 2 finding(s)
• Directives — 1 finding(s)
• Retention — 1 finding(s)
• duplication — 1 finding(s)
• Total: 184 finding(s)

Deep dive: homeboy audit data-machine --changed-since b51839d

Tooling versions

• Homeboy CLI: homeboy 0.179.9+be5659aa
• Extension: wordpress from https://github.com/Extra-Chill/homeboy-extensions
• Extension revision: 0dd8782
• Action: unknown@unknown