fix(cli): relay Claude native launch modes safely

[andrei-hasna]

Summary

• relay Claude headless launches through native print mode and convenience background launches through exact native --bg --name <validated-name> argv
• remove the rejected Accounts background supervisor, payload, session-id, status, log, stop, and attach lifecycle; Claude owns those semantics
• validate raw/convenience/alias/duplicate/name/UUID conflicts before configs prelaunch, active-profile mutation, keychain access, or launch
• serialize macOS keychain leases across processes, capture prior state strictly in memory, and restore it after native dispatch/exit/error/signal paths
• keep Claude stdout clean, route Accounts diagnostics to stderr, preserve cwd/argv/exit behavior, and add Ubuntu/Windows portable smoke

Validation

• bun run typecheck; bun run test:compat
• clean local-storage environment: bun test -> 320 pass, 15 expected platform/Postgres skips, 0 fail
• focused portable fake-Claude/fake-security suite -> 44 pass, 0 fail
• bun run build; bun run contracts:no-cloud-scan
• SDK/contracts tests and examples conformance
• vendor-kit check and repository conformance
• gitleaks staged scan and full ae89e37e..aafe9d9 PR-range scan
• CI at aafe9d9: full test/PostgreSQL/contracts, Ubuntu portable, Windows portable, and secret-scan all green
• branch protection confirmed: PR review gate, strict required test + secret-scan, admin enforcement, force-push disabled, deletion disabled

Scope

Seven files against main. No storage, server, migration, generated-kit, cloud, deploy, publish, tag, install, real-profile launch, or merge changes.