Make pairing recovery race-proof

[Chris-ObtuseAI]

What changed

• wait for every managed controller, agent, relay, and intelligence sidecar to exit before rotating enrollment state
• self-heal a narrowly bounded stale worker-credential allowlist only while the authoritative setup marker is present
• preserve active owner and worker credentials outside setup mode
• bind the Windows private-network firewall marker to the actual installed executable directory so upgrades cannot silently retain rules for an obsolete path

Root cause

Pair again terminated sidecars asynchronously and immediately reset the runtime. A retiring worker could recreate agent.controller-pin.json after reset, so the next encrypted invitation was rejected as this machine is already enrolled. The firewall readiness marker also outlived installation-path changes.

User impact

A user can leave or reset a fabric and immediately enroll again without manually finding or deleting runtime files. Active enrollments remain fail-closed and untouched. An upgraded installation automatically repairs stale private-network rules for the current binaries.

Validation

• cargo fmt --all -- --check
• cargo check -p rampage-desktop --all-targets
• cargo test -p rampage-desktop — 24 passed
• cargo clippy -p rampage-desktop --all-targets -- -D warnings
• scripts/Test-Rampage.ps1 -SkipOllama — full Rust, UI, SDK, intelligence, controller/agent, encrypted storage, authenticated mesh, model gateway, restart/fencing, and E2E gates passed