Function persist_oauth_binding_or_synthetic 

fn persist_oauth_binding_or_synthetic(
    wstore: &Arc<WaveStore>,
    broker: &Arc<Broker>,
    into_bundle_id: Option<&str>,
    provider_id: &str,
    bundle_dir: Option<&str>,
    session_id: &str,
) -> String

On a successful OAuth handshake (CLI exited 0 + authCheckCommand confirmed), persist the OAuth binding into the bundle and return the real bundle id to use in the Success wire status.

“Persist the binding” =

1. Upsert an IdentityAccount with:
   • provider = <provider_id>
   • kind = “oauth”
   • secret_ref = SecretRef::OAuthConfigDir { dir }
   • status = “valid”
2. Bind it via bundle_identity_bind(bundle_id, provider, account_id).
3. Publish identitybundlebindings:changed:<bundle_id> so the Launch modal (and any other open Identity pane) re-fetches the new binding and the launch button enables without a manual refresh.

Per-binding errors (account upsert, bind, broker publish) are logged + downgraded — the success transition still fires with the real bundle id when possible, and falls back to the legacy pending-bundle-for-<sid> synthetic when not. The OAuth CLI’s tokens are already on disk inside bundle_dir either way; the resolver layer (PR B) just won’t find a binding to point at them. Same shape as inject_identity_env’s “log + skip, never abort”.

When into_bundle_id is empty or bundle_dir is None, returns the synthetic placeholder unchanged — the legacy ambient path (PR A behaviour) is preserved.