[Task] Add org installation S2S credential renewal to the Copilot SDK

## Outcome

Long-running SDK sessions can refresh GitHub App credentials without restarting the session or forcing repeated OAuth flows.

## Scope

- Add a supported credential-provider mechanism for lazy or proactive refresh
- Support S2S installation token re-minting before or after the one-hour expiry
- Support U2S refresh tokens and discoverable token lifetime policies
- Retry safely when a token expires during a turn
- Replace reliance on the experimental `session.auth.setCredentials` workaround
- Preserve existing static token behavior

## Acceptance criteria

- [ ] A session running longer than one S2S token lifetime continues without manual token injection
- [ ] A request encountering token expiry can obtain a fresh credential and retry without duplicating unsafe work
- [ ] U2S refresh does not force a new interactive OAuth flow on normal expiry
- [ ] Refresh failures surface clearly and never silently fall back to another identity
- [ ] Node, Go, .NET, and Java SDK behavior is consistent or explicitly staged
- [ ] Public SDK documentation includes secure private-key and refresh guidance

## Dependencies

Coordinate runtime credential update behavior with the bundled CLI. The basic `gitHubToken` acceptance fix remains tracked in github/copilot#30423.

## References

- Parent epic https://github.com/github/copilot/issues/30409
- ADR https://github.com/github/copilot/pull/30449
- Existing prior art github/copilot-sdk#1748

从 ADR github/copilot#30449、先前的工作 github/copilot-sdk#1748 以及父 epic github/copilot#30409 开始。检查 SDK 的 credential-provider 和 session-auth 入口点，然后协调运行时 credential 更新与随附的 CLI。完成标准包括：安全的 S2S 和 U2S refresh、过期时的 retry 行为、保留静态 token、SDK 行为保持一致或分阶段实施，以及安全的公共文档。

由索引模型根据 Issue 内容生成。