fix: harden oauth popup handshake

[aryasaatvik]

Summary

• keep OAuth waiting state active until an actual callback result arrives
• add BroadcastChannel fallback for popup callback delivery
• add explicit cancel controls for MCP and Google Discovery OAuth waiting states

Verification

• bun run --cwd packages/plugins/mcp typecheck
• bun run --cwd packages/plugins/google-discovery typecheck
• bun run --cwd packages/plugins/mcp test
• bun run --cwd packages/plugins/google-discovery test

Note: apps/local typecheck still fails on an unrelated existing core API type mismatch in packages/core/api/src/handlers/executions.ts.