fix(workspace): handle transient OIDC discovery failures

Classify discovery HTTP responses and retry only transient failures.\nAdd tests covering transient retry, not-configured handling, and IOException retry exhaustion.