auth: API 37 Auth Tab drops the OAuth callback on Chrome 145

[altaywtf]

Part of #14. Discovered while proving #105 on the reusable API 37 phone harness.

Original observation (superseded diagnosis)

• Chrome 145.0.7632.218 advertises the AndroidX Auth Tab service category and passes the harness readiness check.
• OAuth client 9677 uses exact callback putio://auth.
• The first interactive authorization reaches the official confirmation page, then leaves a blank Auth Tab instead of returning a successful activity result.
• Closing that tab returns the app to neutral signed-out state.
• After the client is already authorized, later sign-in attempts auto-redirect and return RESULT_CANCELED with no result URI.
• The pending OAuth attempt is consumed; no encrypted token is written.

No token, callback interception intent filter, CLI-token export, or config-file bypass was used.

Current status

The successful live run recorded in the continuation handoff superseded the Android production-code diagnosis. The blocker was external callback registration/configuration.

#115 is merged and adds callback-result regression coverage. The canonical gate and both debug assemblies passed. Production authentication code and manifest are unchanged.

This issue remains open until first authorization and repeat sign-in have identifiable runtime proof.

Outcome

The real API 37 OAuth flow reliably returns its callback to the app and reaches Files for both first authorization and an already-authorized client.

Acceptance criteria

• Reproduce and classify whether this is app launch configuration, Chrome 145 Auth Tab behavior, or provider redirect shape.
• Keep the fail-closed Auth Tab transport; do not add an exported custom-scheme intent filter.
• Verify RESULT_OK carries the callback URI without logging token material.
• Verify sign-in reaches Files, survives force-stop/relaunch, and records safe emulator evidence.
• Add regression coverage at the owning boundary (test(auth): lock Auth Tab callback contract #115).
• Run the canonical gate and API 37 proof.

[altaywtf]

Reconciliation 2026-09-08: #101 preserves the newer OAuth attempt and #131 added the debug client override since the last update. Only the runtime-proof boxes remain; this is now a proof-recording task on the API 37 harness, not a code task.