fix(auxiliary_client): demote the 2 sibling routing fall-throughs too (review)

Phase 2c review flagged that only 2 of the 4 structurally-identical
resolve_provider_client routing dead-ends were demoted. Complete the bug-class:
also demote+dedup the external-process ('not directly supported') and OAuth
('not directly supported, try auto') fall-throughs, keyed by provider name, so
none of the four dead-ends spam WARNING on a retry loop.

Add direct tests for the unhandled-auth_type and OAuth dedup paths via a
monkeypatched PROVIDER_REGISTRY (the review noted these were unverified).
Mutation-checked: reverting either sibling demotion fails its test.

tests/agent/test_auxiliary_client_resolve_dedup.py

@@ -50,3 +50,69 @@ class TestUnknownProviderDedup:
             if "unknown provider" in r.getMessage()
         ]
         assert len(recs) == 2
+
+
+class TestUnhandledAuthTypeDedup:
+    def setup_method(self):
+        ac._LOGGED_UNHANDLED_AUTHTYPE_KEYS.clear()
+
+    def test_unhandled_auth_type_logs_debug_once_not_warning(self, caplog, monkeypatch):
+        import hermes_cli.auth as auth
+        from hermes_cli.auth import ProviderConfig
+
+        # A registered provider whose auth_type matches no handled branch →
+        # the terminal "unhandled auth_type" fall-through.
+        bogus = ProviderConfig(
+            id="bogus_authtype",
+            name="Bogus",
+            auth_type="totally_unhandled_scheme",
+        )
+        patched = dict(auth.PROVIDER_REGISTRY)
+        patched["bogus_authtype"] = bogus
+        monkeypatch.setattr(auth, "PROVIDER_REGISTRY", patched)
+
+        with caplog.at_level(logging.DEBUG, logger="agent.auxiliary_client"):
+            client, model = resolve_provider_client("bogus_authtype", "")
+            resolve_provider_client("bogus_authtype", "")  # repeat → suppressed
+
+        assert (client, model) == (None, None)
+        recs = [
+            r for r in caplog.records
+            if "unhandled auth_type" in r.getMessage()
+        ]
+        # Two calls, one DEBUG record, never WARNING.
+        assert len(recs) == 1
+        assert recs[0].levelno == logging.DEBUG
+        assert not any(r.levelno >= logging.WARNING for r in recs)
+
+
+class TestUnsupportedOAuthDedup:
+    def setup_method(self):
+        ac._LOGGED_UNSUPPORTED_OAUTH_KEYS.clear()
+
+    def test_unsupported_oauth_provider_logs_debug_once(self, caplog, monkeypatch):
+        import hermes_cli.auth as auth
+        from hermes_cli.auth import ProviderConfig
+
+        # A registered oauth_* provider that is not one of the directly-handled
+        # names (nous / openai-codex / xai-oauth) → the OAuth dead-end branch.
+        bogus = ProviderConfig(
+            id="bogus_oauth",
+            name="BogusOAuth",
+            auth_type="oauth_device_code",
+        )
+        patched = dict(auth.PROVIDER_REGISTRY)
+        patched["bogus_oauth"] = bogus
+        monkeypatch.setattr(auth, "PROVIDER_REGISTRY", patched)
+
+        with caplog.at_level(logging.DEBUG, logger="agent.auxiliary_client"):
+            resolve_provider_client("bogus_oauth", "")
+            resolve_provider_client("bogus_oauth", "")
+
+        recs = [
+            r for r in caplog.records
+            if "OAuth provider" in r.getMessage() and "not " in r.getMessage()
+        ]
+        assert len(recs) == 1
+        assert recs[0].levelno == logging.DEBUG
+        assert not any(r.levelno >= logging.WARNING for r in recs)