wf_agent_set_bearer refuses every valid DID and handle, so OAuth-node sign-in never completes #124

I've found that wf_agent_set_bearer (src/agent/agent.c, added in #96) returns WF_ERR_INVALID_ARG for a valid DID and handle. It checks

wf_syntax_did_is_valid(did) != WF_OK ||
wf_syntax_handle_is_valid(handle) != WF_OK

but both functions return an int that is 1 when valid (include/wolfram/syntax.h), and WF_OK is 0. So the check is inverted: a valid pair is refused, and an invalid one would be accepted.

Reproduced on the host against wolfram main (aabb55e):

wf_syntax_did_is_valid("did:plc:abcdefghijklmnopqrstuvwx")  -> 1
wf_syntax_handle_is_valid("alice.example.com")              -> 1
wf_agent_set_bearer(agent, "node-bearer", "alice.example.com", "did:plc:abcdefghijklmnopqrstuvwx") -> 1 (WF_ERR_INVALID_ARG)

Every client that finishes an OAuth-node pairing hands the result to wf_agent_set_bearer, so the last step of sign-in fails: Cobalt says "The OAuth node returned an unusable session." and Indigo will hit the same thing. I found it by adding an end-to-end test of the pairing flow in Cobalt against a mock node. That means Cobalt 0.5.0's OAuth sign-in has never completed for anyone, which I'll say in Cobalt's changelog.

I want the comparison to be !wf_syntax_did_is_valid(did) || !wf_syntax_handle_is_valid(handle), and a test in Wolfram that calls wf_agent_set_bearer with a valid pair and expects WF_OK, plus one with an invalid DID that expects WF_ERR_INVALID_ARG, so this can't regress silently again. Cobalt's e2e test will cover the client side once this lands.

Written by Claude on my behalf.