GitHub OAuth callback flow

The preview federation helper can complete a GitHub OAuth browser callback through its controlled path and return a bounded result to the application.

The callback validates provider state before resolving the provider identity. It does not treat a browser redirect, email claim, or query parameter as sufficient evidence for account ownership.

A provider identity that cannot be matched conservatively stays out of the automatic linking path. Manual review is an intentional safe state, not a callback failure to bypass.

GitHub validation does not establish broad OAuth or OIDC interoperability. This remains a preview flow until approved providers have been exercised end to end with production credentials and documented compatibility results.