power-pages: bump to 2.6.3 (#279)

Follow-up to PR #252 review: drop the "equally valid and secure"
editorializing on the client-secret line in idp-provisioning-reference.md
and bump the power-pages plugin version 2.6.2 -> 2.6.3 (both manifests).


Copilot-Session: 9d45d1dd-29de-444f-8496-af7f85f22ef6

Co-authored-by: Ramachandran R <ramacr@microsoft.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: 3 people

plugins/power-pages/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "power-pages",
-  "version": "2.6.2",
+  "version": "2.6.3",
   "description": "Create and deploy Power Pages sites using modern development approaches. Supports code sites (SPAs) with React, Angular, Vue, or Astro. Includes ALM orchestration (plan-alm) with a solution-splitting decision tree, per-solution pipelines, Azure Blob asset advisory, manifest schema v2 for multi-solution deployments, and force-link remediation for cross-host pipeline migrations.",
   "author": {
     "name": "Microsoft",

plugins/power-pages/.plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "power-pages",
-  "version": "2.6.2",
+  "version": "2.6.3",
   "description": "Create and deploy Power Pages sites using modern development approaches. Supports code sites (SPAs) with React, Angular, Vue, or Astro. Includes ALM orchestration (plan-alm) with a solution-splitting decision tree, per-solution pipelines, Azure Blob asset advisory, manifest schema v2 for multi-solution deployments, and force-link remediation for cross-host pipeline migrations.",
   "author": {
     "name": "Microsoft",

plugins/power-pages/skills/setup-auth/references/idp-provisioning-reference.md

@@ -26,7 +26,7 @@ Everything Power Pages needs downstream (Authority, MetadataAddress, ClientId) i
 
 ## Client secret: code id_token is the default
 
-Power Pages' default OIDC response type is **`code id_token`**: the ID token returns on the front channel, so the app is a **Web application** that needs **no client secret**. A confidential-client app with a client secret is equally valid and secure — the only tradeoff is storing and rotating the secret (Phase 8.1.1 Key Vault).
+Power Pages' default OIDC response type is **`code id_token`**: the ID token returns on the front channel, so the app is a **Web application** that needs **no client secret**.
 
 **Default to `code id_token`; configure a client secret only when the user prefers a confidential client.**