[TheGreatAxios]

Summary

• The vendored oauth-core copy is retired: packages/connections now resolves @corbits/oauth-core from the pinned github:corbitsdev/corbits-oauth-core#v0.1.1 tag (merged upstream commit e1e69e6, hash-locked in bun.lock), which adds the configurable loopback-only callback bind host the sidecar-hosted OAuth login needs.
• vendor/intx/oauth-core/ is deleted outright along with its VENDORED.md ledger row and kill-dates entry — the dependency is no longer vendored, per the owner ruling to fix non-Interchange corbitsdev repos upstream and consume pinned tags.
• The API the token session consumes (createTokenSession, TokenSessionDeps, error classes) is unchanged; stale "vendored" comments in the consumers are updated.

Verification

• bun run check exits 0 (typecheck, lint, full test matrix, structural checks) before the commit; bun run check:structural killdates exits 0 with the oauth-core rows removed.
• bun test packages/connections/src/token-session.test.ts exits 0 against the git-dep copy.
• git grep proves zero vendor/intx/oauth-core references remain; the lockfile resolves the tag to e1e69e6 with an integrity hash.
• Independent review of the full diff returned clean after three stale-comment fixes.

Closes CL-7512

[linear-code]

CL-7512

[TheGreatAxios]

Self-review (code-review skill) returned clean. Reviewer-of-record checks (commit subject/body style audits, diff-stat binary scan, commit-scope check) ran in-session on the final history; the deeper behavioral read ran as an independent review round whose three stale-comment findings are fixed in this tree.