Non-technical install path + OAuth/CORS guidance for Excel add-in
Takeaway: Next time I'd ask for the worktree isolation and the full install/CORS rewrite in one go, since that's basically what happened and it went smoothly with the agent doing its own research before editing.