Fix silent auth refresh and prepare 0.6.5 release

[skvark]

Summary

• restore silent refresh for expired local logins when a valid refresh token and OAuth client registration exist
• retain credentials across transient refresh failures and surface the underlying failure instead of a false AUTH_REQUIRED missing-token barrier
• report missing OAuth client registration explicitly
• add file-backed cross-layer coverage for authenticated package/source search
• prepare the root githits 0.6.5 release across npm, plugin, Gemini, and MCP registry manifests

Root cause

A recent credential-persistence change correctly retained expired credentials after transient refresh failures, but TokenManager.getToken() returned undefined. Authenticated service calls interpreted that as an absent local login and raised the generic AUTH_REQUIRED barrier, even though a refresh token still existed.

0.6.5 release notes

• Fix automatic login refresh so normal access-token expiry remains noninteractive.
• Preserve recoverable credentials when refresh transport, timeout, or server failures occur; later calls retry automatically.
• Support fixed OAuth callback ports for SSH port-forwarding and constrained remote environments (merged in fix: support SSH callback ports in init #230).
• Refresh runtime and workflow dependencies (merged in chore(deps): refresh runtime and workflow dependencies #231).

This is a root-only release. @githits/mcp remains at 0.6.3 because its published package surface did not change.

Validation

• bun test — 2504 passed
• bun run typecheck
• bun run lint — no errors; one pre-existing non-null assertion warning
• bun run build
• bun run validate:packages
• source CLI unauthenticated smoke
• source MCP registration smoke
• built CLI unauthenticated smoke
• built MCP registration smoke
• authenticated live CLI/MCP smoke reached the backend; later example calls were rate-limited with HTTP 429, unrelated to authentication
• mcp-publisher v1.7.9 checksum verification and server.json registry validation
• MCP registry domain proof returned 200
• OAuth protected-resource metadata returned 200
• unauthenticated remote MCP initialize returned 401 with the expected resource_metadata challenge