## What changed
- Resolve stored enterprise IdP sessions against discovered authorization
metadata, requiring the configured issuer, public-client authentication, and
supported ID-JAG token exchange capabilities.
- Bind OIDC identity claims and MCP resource indicators to their configured
issuer, client, and server, and require reauthentication when pinned keyring
credentials are removed or replaced.
- Hold the credential lock while rereading refresh tokens, and isolate
enterprise credentials by reserved namespace and Codex home.
## Testing
- Cover metadata and claim validation, resource binding, credential replacement
and keyring failures, refresh locking, expired ID tokens, and credential
namespace isolation.
GitOrigin-RevId: edce3c6159f7d6831edf72e9608b3fc3f5823c83
9b4a0f8a0a