Vouch request: MCP OAuth fix (silent browser-open failure + truncated authorize URL)

[DylanBohlender]

Hi - I'd like to be vouched to contribute a fix for a silent MCP OAuth failure I hit on Windows; full root-cause with repro in #4418. Short version: the browser auto-open fails silently, and the TUI renders the fallback authorize URL truncated with no indicator - the trailing code_challenge_method=S256 is lost, so S256-only providers (Linear, in my case) reject the flow as plain PKCE.

Patch is ready on a local branch: a short /launch redirect served by the existing loopback callback server as the copy target, plus a PATH-independent Windows opener. Verified E2E against Linear's production OAuth server; 10 new/updated tests pass and bun run check is green in packages/ai and packages/coding-agent. Happy to adjust scope in review.

Love the harness - been living in it daily, and I expect to keep sending bug reports and fixes.

[DylanBohlender]

Quick update: roboomp implemented my design from #4418 as #4420 and has offered to defer to my branch if maintainers prefer. The Codex auto-review then flagged a /launch/callback-path collision in #4420 that my pre-existing branch already handles (with a regression test), and I have the opener-telemetry follow-up ready as a commit on top of #4420's head. Happy to make my fix a bona fide three-fer.

[can1357]

!vouch @DylanBohlender
Tyvm, please feel free to PR the improved version!

[DylanBohlender]

Bless - #4638 and #4639 are now up.