Fix two valid issues identified in automated code review:
1. Fix OAuth callback AppState to preserve pending_approvals
- Clone existing pending_approvals instead of creating empty HashMap
- Prevents loss of shell approval requests during OAuth flow
2. Add validation to activate_kubeconfig
- Check that kubeconfig ID exists before activation
- Return error if ID not found to prevent silent failure
Invalid findings clarified:
- Ollama retry logic is correct (anyhow::bail exits immediately)
- systemctl classification already handles subcommands correctly
(lines 230-239: status/is-active/is-enabled are Tier 1)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>