A provisioned Keycloak client inherits no PKCE pin, and the obvious fix is inert

Keycloak 26.7.1, in a realm where every hand-authored client carries "pkce.code.challenge.method":...