[gemini-cli] bug(mcp): MCP OAuth fails to obtain refresh_token and drops client_secret during background token refresh

## Observed symptom bug(mcp): MCP OAuth fails to obtain refresh_token and drops client_secret during background token refresh When configuring and using remote MCP servers that utilize OAuth 2.0 with Google endpoints (such as Google Workspace APIs like Docs, Sheets, Slides, Drive) or other confidential OAuth providers requiring a `client_secret` for token refresh: 1. **No Refresh Token Issued:** On initial interactive authentication via `/mcp auth <server>`, Google's authorization server only issues a 1-hour `access_token` and **no `refresh_token`**. This occurs because `buildAuthorizationUrl` (`packages/core/src/utils/oauth-flow.ts`) constructs a generic RFC 6749 authorization URL without requesting `access_type=offline` and `prompt=consent` for Google endpoints (unlike the CLI's internal login flow in `packages/core/src/code_assist/oauth2.ts`). 2. **`client_secret` Discarded During Refresh:** When a refresh token is present, background token refresh fails against Google's token endpoint (`https://oauth2.goog ## Literal error text ``` packages/core/src/utils/oauth-flow.ts ``` ## Environment GitHub google-gemini/gemini-cli #29577 ## Trigger / context Public GitHub report in google-gemini/gemini-cli (FRESH_7D). ## Source evidence - https://github.com/google-gemini/gemini-cli/issues/29577 (2026-09-30T09:10:18Z) — evidence_class: PRIMARY_ISSUE_REPORT — #29577 ## Freshness - classification: FRESH_7D - retrieved_at: 2026-10-02T10:44:03.802689Z - scout_id: C11f7c395c6 ## Scout notes This Problem was published by the KFA Fresh Friction Scout from public sources. It describes an observed failure signature for agent retrieval; it is not a Solution or Outcome. Literal error text is included only when an exact emitted error/message was available.