fix(auth): share xAI OAuth refresh across profiles

[DmitryPogodaev]

Summary

• store xAI OAuth token reads/writes in the global root auth store so named profiles share one rotating token pair
• add a dedicated xAI OAuth auth-store lock and keep xAI saves from changing active_provider
• sync profile-local loopback_pkce pool entries from the shared root singleton and write token rotations back there
• document the cross-profile xAI OAuth behavior

Test Plan

• python -m pytest tests/agent/test_credential_pool.py tests/hermes_cli/test_auth_profile_fallback.py tests/hermes_cli/test_auth_xai_oauth_provider.py tests/hermes_cli/test_xai_oauth_pkce_token_exchange.py tests/run_agent/test_codex_xai_oauth_recovery.py tests/hermes_cli/test_tools_config.py -q -o 'addopts='
• python -m py_compile hermes_cli/auth.py agent/credential_pool.py

[teknium1]

Thanks for sending this fix. An automated hermes-sweeper review found that current main now implements this behavior via the merged #46614.

Evidence:

• hermes_cli/auth.py:3946 on origin/main resolves xAI OAuth tokens through profile state/pool and falls back to the global root store when needed.
• hermes_cli/auth.py:4052 and hermes_cli/auth.py:4078 write rotated xAI OAuth tokens back through the global-root write-through path when a profile is using root state.
• hermes_cli/auth.py:4046 persists providers.xai-oauth with set_active=False, preserving the user's active provider while updating the shared token chain.
• The merged implementation is in fix(auth): resolve xAI OAuth credentials across profiles + write rotated tokens back to root #46614, merge commit 8844e091c1c8edac8347649487c5e6a4d82560bf, with the write-through commit 497352bc4e53f824900ae76219d1e5c315b1a15f.
• Regression coverage exists in tests/hermes_cli/test_xai_oauth_writethrough.py:51 and tests/hermes_cli/test_xai_oauth_profile_auth.py:41.

Closing as implemented on main. This was an automated hermes-sweeper review.