OAuth follow-ups: DCR off by default on 2.38, unnoticed nightly scope failures, CLI inheriting CODER_SESSION_TOKEN #1140

Follow-ups found while fixing OAuth scopes (#1138) and adding the live scope suite (#1128).

1. OAuth sign-in fails on 2.38+ unless an admin enables dynamic client registration

On release/2.38 and main, dynamic client registration (DCR) is a runtime setting that is off by default. Admins turn it on with PUT /api/v2/oauth2-provider/settings and {"dynamic_client_registration_enabled": true}.

Discovery (/.well-known/oauth-authorization-server) still lists registration_endpoint, so the extension offers OAuth. Then POST /oauth2/register fails with 403 invalid_request: Dynamic client registration is disabled on this deployment, and sign-in fails with no hint at the cause.

Proposed: when registration is refused, show an error naming the setting, and fall back to session-token sign-in.

2. Nightly scope-suite failures notify almost no one

.github/workflows/oauth-scopes.yaml runs nightly against ghcr.io/coder/coder-preview:latest to catch server-side changes before they ship, such as new OAuth or DCR requirements, or a changed scope or permission. GitHub emails a failed scheduled run only to the user who last edited the cron line, so a failure can go unnoticed.

Proposed: when a scheduled run fails, open or update a tracking issue (for example with gh issue create, or by commenting on an existing issue).

3. CLI calls inherit the extension host's environment, including CODER_SESSION_TOKEN

Every CLI call spawns the binary with the full process.env:

• runCliCommand in src/api/workspace.ts (coder start, coder update)
• src/core/cliExec.ts (speedtest, support bundle, ping)

The CLI prefers CODER_SESSION_TOKEN over the session the extension stores, whether in the --global-config directory or the keyring. If the extension host's environment has that variable, as it does inside some Coder workspaces, these commands run with that token instead of the user's session. They then fail with 401 You are signed out, or act as a different user. The live suite hit this when run from a Coder workspace and now unsets the variable.

The SSH ProxyCommand that Remote-SSH spawns may be affected the same way (not verified).

Proposed: pass the CLI an environment without CODER_SESSION_TOKEN, and probably without other CODER_* auth variables, since the extension already passes --url and the stored session explicitly.