fix(moa): route xai-oauth references through direct credential path

[Ne0teric]

Problem

The auxiliary_client.call_llm path used for MoA reference models does not support OAuth-backed providers. When xai-oauth is configured as a reference provider, each call silently fails and the Grok responses are dropped. The aggregator still returns results, so the failure is invisible unless you check agent.log for warnings.

Fix

Adds _call_reference_direct() — resolves xai-oauth credentials through resolve_runtime_provider() (the same JWT resolution the main model path uses) and creates a direct OpenAI client, bypassing call_llm entirely.

Only xai-oauth is routed through the direct path. Other OAuth providers (nous, openai-codex) continue through call_llm as before.

Testing

• 17/17 existing MoA loop tests pass
• 107/107 model metadata tests pass
• End-to-end verified: both grok-build-0.1 and grok-4.3 respond through the direct path

[alt-glitch]

This was generated by AI during triage.

Resubmission of closed same-author #53602 (rebased onto current main). Same xAI-OAuth-in-MoA family as #53801 (MoA aux concrete-provider routing) and #34171 (xai-oauth aux 403 on Responses API) — distinct code paths, so related, not duplicate.

[Ne0teric]

Closing — superseded by auxiliary_client improvements. The code path ( → wrapper → branch for xai-oauth) now handles OAuth-backed credential resolution properly. Tested live: both grok-build-0.1 and grok-4.3 references respond correctly through the standard path without . The bypass approach is no longer needed.