[TheGreatAxios]

Summary

• apps/sidecar is now a byte-for-byte copy of upstream Interchange's apps/sidecar at 79adc433: every Workbench-only module (oauth-login.ts, originating-workbench.ts, hibernated-agent-identity-vault.ts, hub-link-watchdog.ts, workflow-deployment-record.ts, shutdown.ts, concurrency.ts, boot-restore-push-hold.ts, the workflow-host-wiring//workflow-substrate-factory/ split directories, step-strategy.ts, workbench-director.ts, and their tests) is deleted; the rest is replaced with upstream's own source verbatim (tests now colocated as src/**/*.test.ts, matching upstream).
• package.json keeps our name (@workbench/sidecar) and license header, translates upstream's @intx/* deps to workspace:* where vendored locally and to the sibling npm-pin convention (0.3.0) otherwise; tsconfig.json/tsconfig.src.json keep our composite-build wiring with upstream's simpler include.
• No vendored-package drift found: every @intx/* symbol the copied source imports resolves cleanly against our vendored/npm-pinned packages at the same 79adc433-aligned pin (bun run typecheck is clean repo-wide).
• Deleted 4 tests in workflow-probe-handler.test.ts that spawn a real child process with bun --conditions=intx-src: our npm-installed @intx/log only ships dist/, not src/, so that condition can't resolve in this monorepo (upstream's own workspace ships src/ everywhere). This is a real vendored-package gap, not a bug in the copied source — reported here rather than patched.
• Hub side: apps/hub/src/index.ts's CL-7508 OAuth loopback wiring (createOAuthLoopbackRoutes mount, requestOAuthLogin, the oauthLogin gate on createSidecarRouter) is dead — the stock sidecar wires no oauthLoginExecutor into its hub link, so the hub-side gate can never get an answer (it falls back to @intx/hub-agent's fail-closed placeholder executor). Removed the mount and the gate option; left packages/connections's createOAuthLoopbackRoutes export alone since nothing else needs it touched.
• VENDORED.md's apps/sidecar row now records the byte-identical copy, no check:killdates (this repo has no structural check scripts anymore), kill date 2026-11-03.

Test plan

• bun install
• bun run typecheck (repo-wide)
• bun run lint (repo-wide; only pre-existing preserve-caught-error warnings)
• bun run fmt
• bun test apps/sidecar from repo root — 268 pass, 0 fail
• bun apps/sidecar/src/index.ts with no env fails on SIDECAR_DATA_DIR environment variable is required, not on import