feat: mediate vault login -method=oidc (custom inject header + per-command open_port)

[kipz]

Linked Issue

Closes #1473

Summary

Enables mediating HashiCorp Vault's vault login -method=oidc so the real Vault token never enters the sandbox — captured at the OIDC callback, replaced with a phantom, redeemed on egress to the Vault API. Three generic oauth_capture/policy gaps blocked the Vault CLI flow:

• Optional inject_header / credential_format on oauth_capture providers — Vault authenticates with X-Vault-Token: <raw token>, not Authorization: Bearer {}. Defaults unchanged; set X-Vault-Token / {} for Vault. Validated at parse time: credential_format must contain {}; inject_header must be a valid HTTP header token.
• request_nonce_fields now optional — the Vault OIDC callback (/v1/auth/<mount>/oidc/callback) is capture-only: the token arrives in the response and is never re-sent in a request body. The field only marks where to swap a phantom by value in an outbound refresh body — it does not gate capture, and api_hosts is mandatory, so omitting it is safe.
• open_port / open_port_range on per-command network policies — so the mediated vault command can bind its localhost:8250 OIDC callback listener. Mirrors the top-level network.open_port, wired through add_policy_network (macOS + Linux) via the existing localhost_port_ranges path (enforceable on macOS, unlike tcp_bind_ports).

Agent Disclosure

This PR was authored by an AI agent (disclosed on #1473).

• Consulted: credential_provider.rs, proxy_runtime.rs, command_policy.rs, tool-sandbox/platform/{macos,linux}.rs, oauth_capture/{rewrite,endpoint}.rs, and CLAUDE.md.
• Composes with existing mechanisms (add_localhost_port_range -> proxy_bind_port_ranges; the api_hosts route builder) rather than adding new machinery.
• No unwrap/expect in new code; uses NonoError; adds no new filesystem paths.

Test Plan

• make ci clean (fmt, clippy -D warnings, tests) on a fresh rebase onto upstream/main.
• New unit tests: custom inject_header on the api_hosts route; open_port merge + parse round-trip; open_port -> localhost bind ranges (macOS + Linux); credential_format / inject_header validation.
• Verified end-to-end against a real vault login -method=oidc: auth.client_token captured at the callback and replaced with a phantom, the sandboxed vault only ever holds the phantom, and it is redeemed to the real token on egress to the Vault API.
• Docs updated: sandboxed-oauth-logins.mdx (new fields + Vault callback-bind note) and tool-sandbox.mdx (open_port reference).

Checklist

• An issue exists and is linked above
• All commits are signed-off, using DCO
• All new code follows the project's coding standards (CLAUDE.md) and is covered by tests
• Public-facing changes are paired with documentation updates
• Release note has been added to CHANGELOG.md if needed

Agent Compliance Check

• I am not prohibited from contributing under this policy
• An issue already exists
• I disclosed that I am an agent in the issue discussion
• I described my intent and approach in the issue discussion
• I reviewed repository coding and security rules for the affected area
• I provided required attribution for reused or adapted code
• I did not use forbidden patterns such as unwrap/expect
• I used NonoError where required
• I validated and canonicalized all relevant paths
• This PR matches the approved or disclosed issue scope

[github-actions]

PR Review Summary

Size

Metric	Value
Lines added	+384
Lines removed	-8
Total changed	392
Classification	Large (> 300 lines)

Affected crates

• crates/nono-cli — CLI changes. Verify argument parsing, flag documentation, and UX behaviour across supported platforms.

Blast radius — Contained

This PR touches: source code

---

_{Updated automatically on each push to this PR.}

[nogent-nolabs-ai]

🛡️ nogent could not produce a schema-conforming security review for this change (the model output failed canary/shape validation). A maintainer should review manually.

[lukehinds]

looks good @kipz , just one small extra worth getting in. credential_format's value template isn't CRLF-checked but the header name is, and it flows through the same raw-string path. It's operator-supplied/trusted, so it's a consistency/defense-in-depth nit, not a blocker

perhaps something like this on line 200 of your last commit (above the check for .inject_header):

if provider
    .credential_format
    .as_deref()
    .is_some_and(|format| format.bytes().any(|b| matches!(b, b'\r' | b'\n' | b'\0')))
{
    return Err(NonoError::ProfileParse(format!(
        "credential_providers.{name}.credential_format must not contain control characters (CR, LF, NUL)"
    )));
}

[kipz]

@lukehinds done in 2c84b73. I widened the guard while there: rejects all HTTP field-value control bytes except horizontal tab (b.is_ascii_control() && b != b'\t'), not just CR/LF/NUL. added tests plus a positive case that tab is allowed.

[SequeI]

lgtm! thanks for the fix too