feat(auth): support trusted actor-owned builtin OAuth

[bsbds]

Stack 3/5. Depends on bsbds/xagent#82. This staging PR is based on the Gmail ownership lifecycle prerequisite. Upstream branch-creation rules require sequential promotion after PR xorbitsai#1588 merges.

Summary

• add the trusted actor-owned builtin OAuth start boundary
• bind signed state to the exact catalog application and governing team
• revalidate application identity, visibility, and callback association
• persist and reconnect only the exact actor owner namespace
• keep ordinary OAuth setup and callbacks unchanged

Verification

• all changed test modules passed
• full-stack changed-file suite passed
• independent review found no blocking issues
• full pre-commit suite passed

Rollout

Keep the trusted downstream caller disabled until every API and task worker runs the complete four-PR stack.