[access-dev-tunnel-cutover] - Remove parallel Dev Tunnel token providers

[JoshuaRowePhantom]

Part of #1513 and master #1505

Parent

• Direct parent: [access-dev-tunnel] - Track identity Connect-token and bounded-renewal slices #1513.
• Architecture master: [access-broker] - Unify credential-use authorization, acquisition, renewal, and presentation #1505.

Dependencies

• Depends on: [access-dev-tunnel-relay] - Use fixed Connect leases for relay authorization and one replay #1559.
• Depends on: [access-dev-tunnel-cutover] - Remove GitHub Entra and anonymous token providers #1570.
• Depends on: [access-dev-tunnel-cutover] - Remove OAuth and management Connect token providers #1571.

Summary

Delete the old identity/Connect provider interfaces and raw OAuth delegate factory.

Current Limitation / Root Cause

Keeping these interfaces would allow callers to bypass broker release, renewal, and lease rules.

Affected Files

Path	Change
Phantom.Workspaces/Services/DevTunnel/IDevTunnelAuthTokenProvider.cs	Implement the bounded production change owned by this issue.
Phantom.Workspaces/Services/DevTunnel/IDevTunnelConnectTokenProvider.cs	Implement the bounded production change owned by this issue.
Phantom.Workspaces/Services/DevTunnel/DevTunnelAuthTokenProviderFactory.cs	Implement the bounded production change owned by this issue.
Focused test file	Add only the tests listed below.

Design / Fix

This slice implements the following exact contract:

// Remove:
// IDevTunnelAuthTokenProvider
// IDevTunnelConnectTokenProvider
// DevTunnelAuthTokenProviderFactory raw acquisition delegates

Delete only the two interfaces and raw factory after #1570 and #1571 remove every implementation. Update the remaining construction reference to typed executors; no alternate path remains.

Use required-init properties and named object initializers. The commit must build and its focused tests must pass without relying on a second implementation slice landing in the same commit.

Security and Privacy Invariants

• Release/use authorization occurs before material access or provider interaction whenever this slice can reach either boundary.
• No token, secret value, OAuth state, verifier, authorization URL, signed URL, device code, callback, account name, unsafe identifier, or credential-bearing result enters UI-safe state, logs, notifications, entities, or persistence.
• Typed results remain caller-owned and disposable; provider/cache artifacts remain executor-owned.
• Errors are typed and sanitized; no broad catch or success-shaped fallback is introduced.

Exclusions

• No batch API, compatibility bridge, legacy-data migration, silent interactive renewal, or unrelated provider work.
• No production types beyond the bounded files/classes named here.
• No UI work unless this issue is explicitly a UI slice.

Commit Plan

Commit 1 — [access-dev-tunnel-cutover] - Remove parallel Dev Tunnel token providers

Production scope: Phantom.Workspaces/Services/DevTunnel/IDevTunnelAuthTokenProvider.cs, Phantom.Workspaces/Services/DevTunnel/IDevTunnelConnectTokenProvider.cs, Phantom.Workspaces/Services/DevTunnel/DevTunnelAuthTokenProviderFactory.cs.

Tests: AccessMigrationTests methods listed below.

Acceptance: one small coherent commit; no opportunistic adjacent migration.

Expected Tests

Test Name	Class	What It Verifies
AccessMigration_DevTunnelTree_HasNoIdentityTokenProviderInterface	AccessMigrationTests	Verifies the named contract and leaves adjacent slices independently testable.
AccessMigration_DevTunnelTree_HasNoConnectTokenProviderInterface	AccessMigrationTests	Verifies the named contract and leaves adjacent slices independently testable.
AccessMigration_DevTunnelTree_HasNoRawOAuthTokenDelegate	AccessMigrationTests	Verifies the named contract and leaves adjacent slices independently testable.