Managed configuration: clientSecretHelper must print JSON, OIDC sign-in, session retention and desktop-only fields

What

Managed configuration is the set of settings an administrator defines for an organisation's Claude apps. Its definitions and settings page changed in several places.

• clientSecretHelper, a program that hands an MCP server's OAuth client secret to Claude Code, is now described as having to print a JSON object with a single clientSecret key and exit with status 0 within 30 seconds. Any other output is rejected and stops the server from connecting. Before, it was described as printing the secret on its own.
• clientSecret is now trimmed, and when settings are redacted it is shown as present or absent rather than dropped.
• A new "Session retention" group appears under limits.
• A new credential kind, "Identity provider sign-in (OIDC)" (external-idp), is added, and the gateway kind accepts a GATEWAY_INTERACTIVE_WITH_IDP path.
• Many fields, including several Bedrock, Vertex and extension fields, gain executionTarget: "desktop".
• The settings page section Workspace is renamed Capabilities.
• New shared exports include isCoworkSurfaceEnabled, autoModeSurfaces, retiredFlatKeyEffect, keepsAuthoredEmptyList, PROVIDER_SELECTOR_ENV_FLAGS, releasedHybridCredentialKinds and flatKeysForExecutionTarget.
• The settings screen opened when a slash command runs with no arguments now receives a manualDialog value.

Why

Administrators with a clientSecretHelper that prints only the bare secret should change it to print the JSON form, since other output is described as rejected. Organisations can also find OIDC sign-in for gateways and session retention controls in managed configuration.