plugin-auth: `register-sso-provider` emits two lowercase wire-visible error codes (`request_domain_verification_failed`, `verify_domain_failed`) — ADR-0112 violation invisible to the casing gate

[os-zhuang]

Split out of #10658 at triage: that card fixes the GATE (the ||-fallback recognizer blindness in scripts/check-error-code-casing.mjs); this card fixes the two CODES it could not see. Different lane (plugin-auth = services), different risk (wire-visible rename), must not ride a tooling PR.

What

packages/plugins/plugin-auth/src/register-sso-provider.ts emits ObjectStack-authored default error codes in lowercase, as the fallback arm of an || chain:

line	code
411	request_domain_verification_failed
465	verify_domain_failed

e.g. line 465: code: parsed?.code || 'verify_domain_failed'. The parsed?.code path is the vendor pass-through; the literal is ours. ADR-0112 / Prime Directive #3 require SCREAMING_SNAKE for our error codes. Measured at 47aff0938 (see #10658 for the positive control proving the gate misses this spelling).

Constraints for the fix

• Wire-visible rename: any client matching on the lowercase spellings breaks. packages/qa/dogfood/test/admin-route-nonadmin-refusal.dogfood.test.ts:252 pins verify_domain_failed by name — update it in the same PR.
• Clause-② applies: the emitted error vocabulary of a published endpoint changes (restoring declared ADR-0112 casing, but still a public-surface change) — claim should declare Clause-②: yes; contract-review tier at dispatch.
• Coordinate with check-error-code-casing reports a clean sweep it cannot support: a lowercase code in an || fallback matches none of its four recognizers, and two live ones ship today #10658's gate PR: whichever lands second removes the other's temporary expected-finding/allowlist entry so the gate ends up green with zero exceptions.
• Related context: finding: add-member was not the only one — 6 of 17 ObjectStack auth mounts are undocumented and 9 of 17 are in no ledger, and nothing catches a mount that lands without either #10534 (SSO mount documentation card, where the codes were found) — this card deliberately does not touch mounts or docs.

Filed by the triage seat; queue-ready (concrete lines, measured, mechanical edit + pin update).