feat(auth): add pinned X.509 workload token exchange (#2470)

## Summary

Part 1 of 5 in the X.509 workload-identity stack.

- Add the certificate-authenticated OAuth exchange against the single
approved `https://mtls.auth.openai.com/oauth/token` issuer.
- Validate the exact grant/token types, safe bearer syntax, bounded
issuer-approved lifetime, sanitized OAuth failures, caller cancellation,
and fixed issuer deadline.
- Exercise genuine ephemeral mTLS certificates, issuer hostname/SNI
verification, and direct/CONNECT transport boundaries.

## Verification

- Focused issuer-exchange and transport-conformance suites on the
repository runtime and the exact minimum supported Node 22.22.0.
- `pnpm lint`, `pnpm exec tsc --noEmit`, and `pnpm build`.
- Two independent security/code-review rounds; final full-stack Codex
Security diff scan: zero findings.

Next: `codex/x509-02-capability-boundary`.