fix(auth): unify shared authority across profiles (#380)

[cermm]

Summary

Fix shared Hermes auth authority across default and worker profiles.

This PR implements the reviewed NousResearch#380 repair candidate on current fork/main:

• shared auth authority resolution and migration/recovery commands;
• transition/store locking for shared/profile auth writes;
• dry-run migration digest bound to the locked source snapshot;
• reachable auth consumers routed through shared authority (Photon, managed gateway, xAI, auxiliary client, first-run provider detection);
• fail-closed behavior for authority/config errors rather than profile-local fallback;
• focused regression coverage for migration, fallback locks, reachable consumers, and status/cache behavior.

Exact reviewed candidate

• Candidate: 7576b5613b43ec02349f5880c4f533f721a9abe7
• Tree: c9e217da9ea676dc6788d727aa8e89c87553bc8c
• Parent/base: d4b6ecf622c44a96eff2a79b2f0c904e678b2f38
• Reviewed plan SHA: 241e44ae98db174371a26bac9de02883cda910576b59fc6aa14ab9d82d11062b

Verification

Local receipts:

• Allowed path/hunk candidate gate: PASS
  • allowed-paths.candidate.json
• Sanitized candidate evidence: PASS
  • no added-line JWT / sk-* / Bearer findings
• Independent review: PASS/PASS (deleg_848b2661)

Observed local test/smoke results:

• focused current-finding regressions: 3 passed
• scoped shared-auth/cache/write-through/reachable: 102 passed
• wider auth suites: 170 passed
• affected auxiliary suites: 375 passed
• affected managed/xAI/web suites: 214 passed
• temp-home migration + consumer smoke: PASS
  • photon_path_is_shared=True
  • managed_path_is_shared=True
  • managed_token_present=True
  • xai_ready=True
  • auxiliary_nous_present=True
  • main_provider_configured=True

Notes

Direct push to main was rejected by branch protection, so this PR is the required protected route into main.

Refs NousResearch#380