[Task] Complete organization App token renewal using existing SDK providers

从 ADR github/copilot#30449、先前的工作 github/copilot-sdk#1748 以及父 epic github/copilot#30409 开始。检查 SDK 的 credential-provider 和 session-auth 入口点，然后协调运行时 credential 更新与随附的 CLI。完成标准包括：安全的 S2S 和 U2S refresh、过期时的 retry 行为、保留静态 token、SDK 行为保持一致或分阶段实施，以及安全的公共文档。

Outcome

Long-running SDK sessions can refresh GitHub App credentials without restarting the session or forcing repeated OAuth flows.

Scope

• Add a supported credential-provider mechanism for lazy or proactive refresh
• Support S2S installation token re-minting before or after the one-hour expiry
• Support U2S refresh tokens and discoverable token lifetime policies
• Retry safely when a token expires during a turn
• Replace reliance on the experimental session.auth.setCredentials workaround
• Preserve existing static token behavior

Acceptance criteria

• A session running longer than one S2S token lifetime continues without manual token injection
• A request encountering token expiry can obtain a fresh credential and retry without duplicating unsafe work
• U2S refresh does not force a new interactive OAuth flow on normal expiry
• Refresh failures surface clearly and never silently fall back to another identity
• Node, Go, .NET, and Java SDK behavior is consistent or explicitly staged
• Public SDK documentation includes secure private-key and refresh guidance

Dependencies

Coordinate runtime credential update behavior with the bundled CLI. The basic gitHubToken acceptance fix remains tracked in github/copilot#30423.

References

• Parent epic https://github.com/github/copilot/issues/30409
• ADR https://github.com/github/copilot/pull/30449
• Existing prior art github/copilot-sdk#1748