c1-literals: the browser-login button brands are the root legacy table's frozen 1.5.5 rows

[MattJackson]

Drains the c1-literals row crates/busbar-kernel/src/auth/token.rs | github and busbar-kernel × law0 instance:auth 8 → 5. This follows the coordinator's ruling (c): the brands become root legacy-table data.

What changes

• Brands become a legacy row. The kernel's /auth/token chooser inferred three provider brands (label and icon) from the method name and OIDC issuer host, with the brand words spelled in kernel source. Those are frozen 1.5.5 login-page data (v1.5.5 crates/busbar/src/auth/token.rs:1073-1112). They are now:

  • one row in the root legacy table, plugins.yaml legacy: login_brands;
  • rendered into [package.metadata.busbar.legacy];
  • mirrored in the kernel test stand-in;
  • handed in with the rest of LEGACY_ROWS.

  This is the mechanism KN-2c/2d: recorder log line is a frozen root legacy row; kernel diagnostics name no sink or auth plugin (Law 0) #987 also uses; there is no second loader. Each brand is <match tokens> : <label> : <icon ref>, in 1.5.5's match order.

• The kernel matches generically. It matches each method against the handed row. A method that matches nothing, or a build with no row, gets its title-cased name under the generic icon, as before.

• The SVGs stay as plain assets. The three brand SVGs are keyed by icon ref and contain no plugin word. A diff of the brand block against v1.5.5 showed it identical, so the bytes are verbatim.

• No seam is touched. The oauth_as seam and core-oauth2 are unchanged.

• The chooser test names no brand any more: github became second-sso.

Bytes

The shipped binary renders the same HTML, because the root installs the table before any config is read.

RED

the_button_brands_are_the_legacy_row_and_with_no_row_every_method_is_generic:

• With the row, each brand's first token renders that brand's label and icon on the chooser button.
• The issuer host matches the same way the name does.
• An unmatched method renders the generic arm.
• With no row, every brand token renders the generic arm.

Merge safety

• plugins.yaml, Cargo.toml and the fixture: my hunks are disjoint from KN-2c/2d: recorder log line is a frozen root legacy row; kernel diagnostics name no sink or auth plugin (Law 0) #987's rows. Its snapshot_recorder_failed lands at fixture line 28 and Cargo line 728; mine land at fixture line 26 and Cargo line 716.
• token.rs: disjoint from contract: Redacted<T> becomes the sealed Secret<T>; expose(&impl KernelSeal) is the one accessor (#54; stacked on #927+#941) #1021, auth: the mint ceiling binds the self-serve mint (X-1001) #945 and row 166 PR1: secret resolve takes a config-time proof (ConfigScope) and the config-scope gate #863.

Nothing was run locally; CI is the proof.