feat: harden install and resumable OAuth login

install-manifest.json

@@ -30,16 +30,27 @@
   },
   "installation": {
     "requiredTools": ["node", "npm"],
+    "operationDetection": ["fresh-install", "in-place-update", "repair", "already-current"],
+    "supportsInPlaceUpdate": true,
+    "sameCommitBuildSkip": true,
+    "installReceipt": {
+      "path": "<install-prefix>/install-receipt.json",
+      "schemaVersion": 1,
+      "posixFileMode": "0600",
+      "containsSecrets": false
+    },
     "sourceCheckout": false,
     "temporarySourceArchiveBuild": true,
     "fallbackToRelease": false,
     "globalPackageInstall": false,
     "persistentArtifacts": [
       "isolated user-data npm prefix",
+      "non-secret install receipt",
       "non-secret CRM config",
       "private per-user credential file",
       "MCP client configuration and backup"
     ],
+    "preserveOnUpdate": ["CRM config", "per-user OAuth credentials", "read-only or fixed-project-write mode"],
     "defaultBackgroundService": false
   },
   "authentication": {
@@ -49,13 +60,26 @@
     "dynamicClientRegistration": true,
     "browserSignIn": true,
     "automaticRefresh": true,
+    "processRestartResumable": true,
+    "pendingAuthorizationStorage": "short-lived per-user private local file",
+    "userVerificationDelivery": {
+      "fields": ["login_url", "verification_uri_complete", "user_code"],
+      "intendedRecipient": "requesting-user",
+      "channel": "current-private-conversation",
+      "shareableWithIntendedRecipient": true,
+      "publicSharingAllowed": false,
+      "containsBearerCredentials": false,
+      "containsDeviceCode": false,
+      "remoteDesktopRequired": false
+    },
     "manualFallback": "user-controlled-hidden-tty-personal-authorize-key",
     "storage": "per-user private local credential file",
     "posixFileMode": "0600",
     "allowPassword": false,
     "allowAgentChatSecret": false,
     "allowCommandLineSecret": false,
-    "allowEnvironmentSecret": false
+    "allowEnvironmentSecret": false,
+    "allowDeviceCodeExposure": false
   },
   "entrypoints": {
     "guide": "INSTALL.md",