Fix Capacius permissions and exact login recovery ownership

[andrei-hasna]

Prepares the existing Accounts permission/login hardening branch at exact head 3ea97c1.

What changed

• Requires exact canonical raw Claude permission modes: bypassPermissions, auto, acceptEdits, dontAsk, and plan. Accounts preset aliases remain supported, while raw aliases, casing variants, whitespace, and unknown values fail closed.
• Makes the stable migration 0010 blocker reason LOGIN_CLEANUP_MIGRATION_BLOCKER_REASON available from the supported @hasna/accounts root package as login-cleanup-ledger-atomicity, while leaving migration 0010 deployment-blocked.
• Binds new exact-lock reclaim claims to PID, verifiable Linux or Darwin process incarnation, and UUID; preserved legacy aliases remain fail-closed.
• Scopes reclaim cleanup to the exact token and inode acquisition, prevents peer deleters from reaching unlink concurrently, and gives unacquired recovery intents no authority over another acquisition.
• Stabilizes the hosted concurrent-recovery ownership regression by resolving only the crashed login separate profile intent before the two journal contenders, while preserving journal, keychain, and apply ownership evidence.

Local verification

• Focused changed-surface suite: 143 pass, 0 fail, 920 expectations.
• Hosted failing concurrent-recovery case: 10 of 10 independent runs passed, 22 expectations each.
• Full bun test: 559 pass, 23 platform or PostgreSQL skips, 0 fail, 2415 expectations.
• Isolated PostgreSQL integration: 17 pass, 0 fail, 184 expectations; ephemeral database removed and absence verified.
• Typecheck, legacy compatibility typecheck, build, root self-package import, SDK/contracts, no-cloud, contract examples, vendor kit, repository conformance, and portable Claude launch gates pass.
• Non-printing staged, outgoing-delta, and origin/main branch-range gitleaks scans found no leaks before commit and push.

Operational boundary

• This PR remains draft and is not merged.
• Independent exact-head review has not started in this continuation.
• Migration 0010 remains deployment-blocked under reason login-cleanup-ledger-atomicity until SQL execution and checksum-ledger recording are atomic under the same advisory lock.
• This PR does not claim auth-capsule A6 completion.

[andrei-hasna]

Merge blocked: exact-head review found remaining P1 response-loss ABA and pre-rollback crash-intent defects. Remediation is active in the owned worktree; the remote PR still points to the older 6cbff3b head. Do not merge or deploy migration 0010. Deployment also remains gated on atomic migration-runner task f799e8a5-fc9e-4735-bfb9-8a0c17b90b25.