test: align OAuth state coverage with nonce-keyed transients

[chubes4]

Summary

• Updates OAuth state tests to inspect the nonce-keyed transient created by OAuth2Handler::create_state().
• Updates the expiration simulation to delete the actual nonce-keyed transient before verification.

Fixes #1991.

Testing

• homeboy test data-machine -- --filter=OAuth2HandlerStateTest
• homeboy test data-machine --changed-since origin/main
• homeboy lint data-machine --changed-since origin/main

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode (GPT-5.5)
• Used for: Reproducing the CI test failures, identifying stale transient-key assumptions in the tests, updating the focused coverage, and running verification. Chris remains responsible for review and final merge.

[homeboy-ci]

Homeboy Results — data-machine

Lint

✅ lint — passed

ℹ️ Full options: homeboy docs commands/lint
Deep dive: homeboy lint data-machine --changed-since daf7eaf

Test

✅ test — passed

• 18 passed

ℹ️ Auto-fix lint issues: homeboy refactor data-machine --from lint --write
ℹ️ Collect coverage: homeboy test data-machine --coverage
ℹ️ Save test baseline: homeboy test data-machine --baseline
ℹ️ Pass args to test runner: homeboy test -- [args]
ℹ️ Full options: homeboy docs commands/test
Deep dive: homeboy test data-machine --changed-since daf7eaf

Audit

✅ audit — passed

• duplication — 1 finding(s)
• Total: 1 finding(s)

Deep dive: homeboy audit data-machine --changed-since daf7eaf

Tooling versions

• Homeboy CLI: homeboy 0.174.1+0b0f367c
• Extension: wordpress from https://github.com/Extra-Chill/homeboy-extensions
• Extension revision: 03cee04
• Action: unknown@unknown