## Why
A new OAuth login can belong to the same account as an earlier session, while token refreshes can change credentials within one session. Auth consumers need to distinguish these cases when deciding whether a runtime can be reused.
## What changed
- Add `source_generation` to `AuthChangeState` and expose `AuthManager::auth_change_state_for` to check whether selected credentials still match the manager's current source.
- Preserve source continuity across OAuth refreshes only when session, issuer, and identity claims match. Advance the source revision for new sessions, credential replacements, and logout.
- Keep agent identity persistence from replacing cached credentials with credentials read from disk; credential publication remains managed by `AuthManager`.
## Testing
Add tests for refresh continuity, new logins, identity and workspace changes, sessionless tokens, API key replacement, logout, and identity persistence followed by an explicit credential reload.
GitOrigin-RevId: 56eddb7edb9c5f8854b18fd50ce917c0b27e75d6
cooper-oai
7827cd886d