Token harness refresh

[mdeyell-valid-mind]

Adds support to the agent harness integrations so short-lived OAuth access tokens can be refreshed automatically.

I tested this with PI.

When reviewing please look at the docs to make sure those are usable to you.

Changes

• Added token command execution, expiry parsing, caching, and one-time 401 retry support:
• Supports token command output as either:
  • a raw bearer token
  • JSON containing access_token, accessToken, or token
  • optional expiry fields via expires_in, expires_at, or expiresAt
• Persists token caches for the Node integrations under each integration state directory.
• Updates docs for auth-mode setup and short-lived token usage.

[hunner]

Solid, well-tested feature with unusually careful cache handling — the fresh-temp-file + atomic rename dance so 0600 actually applies, the sha256(command + URL) cache keying, the single-flight refresh promise, and the bounded one-shot 401 retry are all right. Enabling Pi in the integration harness so the full mint → cache → re-mint → 401-retry path is exercised end-to-end is great. Docs are accurate to the code (I verified the 55-minute default, skew, cache keying, mode, and retry semantics all match).

Approving with five issues and three nits inline — none blocking, but 1, 2, and 5 are small concrete fixes worth making before merge.

🤖 Automated reply

[mdeyell-valid-mind]

@hunner Thanks, I updated this