Summary

• add strict AuthProviderDescriptor/AuthProviderCapability/AuthProviderConfigField contracts
• add step.auth_provider_catalog for merging provider-owned descriptors
• make auth admin OAuth controls and policy provider advertising descriptor-driven, with Google/Facebook retained only as no-descriptor compatibility fallback
• default missing capability supported state to disabled to avoid false provider functionality

Verification

• GOWORK=off go test ./...
• GOWORK=off go vet ./...
• wfctl plugin validate-contract .
• git diff --check
• autodev plan scope lock verified

Part of locked plan docs/plans/2026-05-27-auth-provider-architecture.md: PR 1 / Tasks 1-2.