Show the device code in the sign-in dialog

[guys-inc-ops]

Sign-in is broken in 3.5.0 for anyone signing in from inside the app. Fixes the report from dampmeme64.

What happens

The browser opens to github.com/login/device, which asks for a code, and the application never shows one. From the user's log:

23:59:18  [SignInStore] initializing OAuth device flow
23:59:18  [main] opening in browser: https://github.com/login/device
          (nothing further)

The request was always fine — the browser only opens because it succeeded. The code was fetched, put into state, and never rendered.

Root cause: two sign-in surfaces, one updated

• Welcome / first-run renders through ui/lib/sign-in.tsx → AuthenticationForm. feat(auth): sign in with the OAuth device flow, stop shipping a client secret #26 taught this one to display the code. It works.

• The dialog — ui/sign-in/sign-in.tsx, reached by re-authenticating, which is what happens when a token is invalidated — was missed. renderAuthenticationStep ignored state.deviceFlow entirely and printed the pre-device-flow copy:

  Your browser will redirect you back to GitHub Desktop once you've signed in.

  That is now false. Nothing redirects back, and the code you need is never shown.

This is why the pre-release GUI sign-in test passed: it exercised first-run, and the user hit re-authentication.

Visible in the published 3.5.0 bundle — device-flow-user-code and Enter this code at each appear once (the welcome flow), alongside the dialog's redirect sentence.

The fix

renderAuthenticationStep now renders the code when state.deviceFlow is set, using the same markup as the welcome form.

The stylesheet needed changing too: _device-flow.scss was scoped to .sign-in-form, the welcome form's class, so even once the dialog rendered the code it would have been unstyled. Now unscoped, with a comment saying why — it is shown from two places.

The standing copy is corrected where it still described the redirect flow, which also affects the existing-account warning step that reuses it.

Verified by building, not by inference

I got this wrong twice before landing it — first blaming CORS, then a renderer/main-process split — because I reasoned from curl and specs instead of running things. So this one is checked against the compiled output:

	3.5.0	this branch
device-flow-user-code	1	2
Enter this code at	1	2
redirect copy	1	0

tsc, eslint, prettier clean. yarn compile:prod exits 0.

Follow-up worth doing separately

Nothing in CI renders a component or launches the app, which is why 1032 passing tests, CodeQL, and the build-secret scan all cleared a build no one could sign into. The secret scan even greps for login/device/code and found it — proving the string compiled, not that a user could reach it. A component test asserting "a sign-in state carrying a device code renders that code", run against both surfaces, would have caught this in milliseconds.