test: restore credential refresh module mocks (#2381)

Capture detached real module exports before mocking and restore secure
storage and device-flow modules after each refresh-on-401 test. This
prevents shared-process credential mocks from breaking provider setup and
saved-profile startup tests in randomized serial runs.

src/utils/githubModelsCredentials.refresh.test.ts

@@ -3,8 +3,16 @@ import {
   acquireSharedMutationLock,
   releaseSharedMutationLock,
 } from '../test/sharedMutationLock.js'
-import * as realDeviceFlow from '../services/github/deviceFlow.js'
-import * as realSecureStorage from './secureStorage/index.js'
+
+// Module namespaces have live bindings: keep detached exports so a module mock
+// cannot replace the implementations that cleanup needs to restore.
+const nonce = `${Date.now()}-${Math.random()}`
+const realDeviceFlow = {
+  ...await import(`../services/github/deviceFlow.js?real=${nonce}`),
+}
+const realSecureStorage = {
+  ...await import(`./secureStorage/index.js?real=${nonce}`),
+}
 
 async function importFreshModule() {
   mock.restore()
@@ -174,6 +182,8 @@ describe('refreshCopilotTokenOn401', () => {
   afterEach(() => {
     try {
       mock.restore()
+      mock.module('./secureStorage/index.js', () => realSecureStorage)
+      mock.module('../services/github/deviceFlow.js', () => realDeviceFlow)
       for (const [k, v] of Object.entries(orig)) {
         if (v === undefined) {
           delete process.env[k as keyof typeof orig]