chore(oauth): remove the producerless request_authorization_code / paste-code presentation #3219

Once #3183 lands, the request_authorization_code / paste-code OAuth presentation has no producer left: the retired Claude subscription provider was its only user, and the live Codex/xAI enrollments are device flows presented through open_external. @M4n5ter and @hqhq1025 both asked for its removal in #3183 review; it was split out so the Consumer-Terms fix and an OAuth-presentation teardown do not share one revert unit. This issue makes that follow-up trackable instead of a comment promise.

Scope — removed end to end (detail in #3183 (comment)):

• protocol/oauth.ts — the request_authorization_code member of OAuthPresentationMethod, its request variant, the authorization_code result variant, and their decoders
• client/oauth-presentation.ts — the request_authorization_code case and the requestAuthorizationCode backend hook
• Desktop runtime-host-oauth-presentation.ts — requestAuthorizationCode, submitAuthorizationCode, and the pending-code state
• Desktop runtime-host-oauth-ipc-main.ts — the complete-authorization channel and handler
• server/oauth-coordinator.ts — #exchangeCode (deliberately left in feat(runtime): retire the Claude subscription OAuth provider #3183 so the removal is root-cause, not field-deep), the exchangeCode input, exchangeOAuthAuthorizationCode, and the exchange/timeout machinery
• runtime/oauth-login.ts — exchangeOAuthAuthorizationCode, buildOAuthLoginAuthorization, pkceChallengeFromVerifier, assertPkceVerifier and the PKCE/state helpers only they use (checked: no production caller)
• core/oauth-subscription.ts — parsePastedAuthorization, constantTimeStringEqual, PENDING_AUTHORIZATION_TTL_MS and the paste-code doc comments
• the tests that exist only to cover the removed path; runtime-host-oauth-ipc-main.test.ts's Codex fixture already drives open_external since feat(runtime): retire the Claude subscription OAuth provider #3183

Kept, because the live device flows import them: requestOAuthEndpointJson, requestOAuthTokenEndpointJson, decodeOAuthInitialTokenPayload, OAUTH_LOGIN_MAX_TOKEN_CHARS, OAuthTokenEndpointError (verified against codex-oauth-enrollment.ts and xai-oauth-enrollment.ts import lists).

This is a wire-contract change (protocol members removed), so it takes its own RUNTIME_HOST_COMPATIBILITY_EPOCH bump — the known cost of splitting, taken deliberately for revert granularity.

Blocked by #3183.