Prove who completes an Arcade connection, not just which browser #76

Follow-up from the #73 review (#73 (comment)).

Problem

The Arcade verifier (agent/arcade_tools/verify.py) proves that the browser finishing a connection is the browser that opened the link, using a session cookie set on /arcade/start. It does not prove that browser belongs to the person the link was minted for.

If person A forwards their connect link to person B and B signs in, B's account is bound to A's identity, and A can then use it through the agent (for example, read B's mail). Arcade's user verification exists to stop this kind of phishing.

The Composio connect path on main has the same property: its link binds whoever completes it to the user id it was minted for.

What #73 does today

/arcade/start shows a page naming who the link was made for and warning that continuing connects the signed-in account to that person, with the provider behind a Continue button. That makes a forwarded link visibly somebody else's. It is not proof of identity.

What a real fix needs

A sign-in on the start page that proves the browser's user is the person the link was minted for. Then the verifier confirms only when that identity matches the ticket's.

Open question: which identity provider? "Sign in with Slack" is the obvious fit, but it needs a Slack app client secret in this repository. AGENTS.md rules that out, because Intelligence owns the Slack app and no platform credential belongs here. Options to evaluate:

• Intelligence providing a sign-in or identity assertion for a Channel's users.
• A workspace IdP (Google or Microsoft) matched on the actor's email.
• Doing the same for the Composio connect path.

Until then, the warning page is the mitigation.