OAuth stack: pre-go-live hardening follow-ups (deferred review findings)

Landing zone for **consequence-assessed nonblocking findings** from reviews of the #370/#376/#478 stack — items whose impact assessment shows no security, contract, data-loss, or declared-platform failure. Severity is determined by impact, not a reviewer's P1/P2 badge; unresolved release defects never land here. Current intentional holds (each has a PR thread with full rationale, pending owner acceptance):

- **Faraday headers-time classification** (#370, the long-held thread): injected clients classify a stalled skip-status body as a bounded transport timeout instead of header-time api_error — Faraday exposes no headers-time callback. Bounded since the Timeout.timeout wall-clock wrap; classification-quality gap remains.
- **Python worker join grace** (#376): the +1s cleanup grace extends the caller's worst-case block to timeout+1s by design; pulling it inside the budget would tax every healthy request.
- **Launchpad-only legacy token providers** (Ruby/Python, #478): pinned to Launchpad's endpoint, no RFC 8707 resource; BC5 flows use TokenManager/AuthManager/CLI. Docstrings now warn.
- **Kotlin JVM binary compatibility for appended params** (#478): pre-1.0 SDK, source-level append-only contract only; synthetic default-arg descriptors change arity regardless, so bridges deliver partial coverage at best.

Start by reading the linked review threads for #370, #376, and #478; the issue names no files or tests. Treat each item as an intentional hold and verify its impact assessment and owner acceptance before proposing any work; done means the relevant PR thread records an accepted resolution.

Written by the indexing model from the issue text.