harness-providers: Copilot device-flow, token exchange, provider (M3)

Offline-verifiable building blocks for GitHub Copilot; network paths are the
flagged live-verification risk and are covered by pure unit tests only.

- copilot/device_flow.rs: OAuth device flow (RFC 8628). No hardcoded client id —
  ai-harness must register its own GitHub OAuth app and pass it in. Pure
  parse_poll_response (pending/slow_down/success/failed) + slow_down interval bump;
  request_device_code/poll_once/poll_for_token (injected sleep).
- copilot/token.rs: copilot_internal/v2/token exchange with cache + single-flight
  refresh (tokio::Mutex) and direct-Bearer fallback on 401/403/404; needs_refresh
  honors a 120s skew and expires_at==0 = never.
- copilot/provider.rs: CopilotProvider over api.githubcopilot.com, routing each
  model to chat/responses/anthropic codec by its /models supported_endpoints
  (parse_models + codec_for_endpoints); headers (X-GitHub-Api-Version, Openai-Intent,
  x-initiator, Copilot-Vision-Request, anthropic-beta for anthropic models).
- 11 unit tests (device-flow parsing, token refresh math, codec routing, /models
  parsing).

Deferred (needs live API + TUI work): EngineHandle::login device-flow modal,
startup /models fetch, auth.json-backed registry wiring.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

crates/harness-providers/src/copilot/mod.rs

@@ -0,0 +1,10 @@
+//! GitHub Copilot: OAuth device-flow login, token exchange, and a provider that multiplexes
+//! the chat/responses/anthropic codecs behind `api.githubcopilot.com`.
+
+pub mod device_flow;
+pub mod provider;
+pub mod token;
+
+pub use device_flow::{DeviceCode, PollOutcome};
+pub use provider::{CopilotCodec, CopilotModel, CopilotProvider};
+pub use token::{CopilotToken, TokenProvider};