0.7: Complete Google OAuth connections and explicit session grants #302

Parent: #289. Inspect source: #291.

Work boundary 4/13 from the approved 0.7 → clients → Inspect sequence.

Dependencies: #299, #301.

Implement Google OAuth using the existing credential broker: consent, secure durable storage, refresh, disconnect and explicit per-session grants.

Acceptance criteria:

• Hermetic consent/refresh/revocation and allowed/denied session grants pass.
• Credentials never enter task files, logs or guest-accessible storage.
• Public credential contracts receive explicit review.

Planned PR boundaries: Broker/storage, service APIs and hermetic acceptance as reviewable milestones.

Implementation progress and evidence: Sprinty in the isolated integration/0.7-clients-inspect worktree. Focused tests during development; fast checks/Citadel per PR; relevant black-box proof for runtime, credential or image boundaries. Respect the active release and machine locks.