fix(ai): 处理 rebase 后 Codex 新增的三项审阅意见

- catalog CHANGELOG 删除 rebase 重放进已发布 [16.1.4] 段落的重复 Claude 4.6 条目，使该段落与上游 main 完全一致（已发布段不可变）
- Duo Agent finally 清理在最终 idle timeout（重试已耗尽）时也发送 stop PATCH，避免代理/LB 持续断连场景下服务端工作流残留
- auth-broker login 仅对 pasteCodeFlow provider 传入 onManualCodeInput，普通 loopback provider 不再让 readline 提示与 HTTP 回调竞争导致终端残留

packages/coding-agent/src/cli/auth-broker-cli.ts

@@ -28,6 +28,7 @@ import {
 	type OAuthCredential,
 	type OAuthProvider,
 	type OAuthProviderInfo,
+	PASTE_CODE_LOGIN_PROVIDERS,
 	PROVIDER_REGISTRY,
 	SqliteAuthCredentialStore,
 } from "@oh-my-pi/pi-ai";
@@ -211,6 +212,12 @@ async function runLocalLogin(provider: OAuthProvider): Promise<void> {
 	const storage = new AuthStorage(store);
 	await storage.reload();
 	try {
+		// Only paste-code providers (fixed non-loopback redirect, e.g. GitLab Duo
+		// Agent's vscode:// URI) get the manual paste fallback. For normal loopback
+		// providers `onManualCodeInput` would make OAuthCallbackFlow race a readline
+		// prompt against the HTTP callback; if the callback wins, the outstanding
+		// prompt is never cancelled and leaves the terminal in a dirty/blocked state.
+		const usesManualInput = PASTE_CODE_LOGIN_PROVIDERS.has(provider);
 		await storage.login(provider, {
 			onAuth({ url, instructions }) {
 				process.stdout.write(`\nOpen this URL in your browser:\n${url}\n`);
@@ -223,12 +230,13 @@ async function runLocalLogin(provider: OAuthProvider): Promise<void> {
 			onPrompt(p) {
 				return ask(`${p.message}${p.placeholder ? ` (${p.placeholder})` : ""}:`);
 			},
-			onManualCodeInput() {
-				// Providers with a fixed non-loopback redirect (e.g. GitLab Duo Agent's
-				// vscode:// URI) never hit the local callback server, so offer the same
-				// paste-the-redirect fallback the interactive TUI sign-in uses.
-				return ask("Paste the authorization code (or full redirect URL):");
-			},
+			...(usesManualInput
+				? {
+						onManualCodeInput() {
+							return ask("Paste the authorization code (or full redirect URL):");
+						},
+					}
+				: undefined),
 		});
 		process.stdout.write(`\nCredentials saved to ${getAgentDbPath()}\n`);
 	} finally {