Fix custodial history migration, scoped decrypt ACKs and online key retirement

[LIghtJUNction]

Refs #68. This PR is the custodial lifecycle change; #69 recovery and #70 Root governance are separate.

Changes

• Activate the proven new EncryptionSubkey at migration start; inventory all retained owned ciphertext, including unreadable/unknown history.
• Keep immutable A (new-recipient ciphertext) and B (only the account's retired encryption subkey, compatibility recovery) mappings; actual CLI decryption precedes signed per-inventory ACKs.
• Add idempotent finalization with exact reviewed loss acceptance or decrypt-only retention. Never retain signing ability in decrypt-only vaults; migrate the PostgreSQL constraint.
• Separate identity switch, history recoverability, old-token revocation, online key deletion and backup retirement. Unverified backups/external ciphertext do not become 'fully retired'.
• Keep published v1 schemas/shortcodes unchanged; new finish/ACK/keystore fields are explicit v2 contracts. Existing signed authority is not automatically expanded.
• Add protected client recovery journal, doctor/selftest checks, regression tests and docs/CUSTODIAL_HISTORY.md.

Verification

34 focused migration and dictionary tests passed locally after the v2 compatibility fix; the 10 added lifecycle/schema security tests also passed. Final full-suite, conformance and PR-head CI are being checked before merge. The earlier failing broad run was not accepted as a passing result.

Temporary content-addressed staging workflows have removed themselves; the final tree contains source/tests/docs only, with no deployment workflow or production action. Backup retirement is explicitly unverified until independently evidenced, rather than falsely asserted.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-09-27T20:37:22.113890Z	04dbc59	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.