Quarantine the unresolved account namespace

The accounts.unresolved.* UserDefaults namespace was found on a real
device holding a stale, contradictory snapshot: a tombstoned account
listed live, context reset to local, every sync outbox still pending.
With iCloud Drive off the identity scope dips to unresolved on every
foreground activation, so that snapshot was loaded — and rewritten —
in an entirely ordinary configuration.

Close it off on four fronts:

- Gate the unprompted writers. reconcileLegacyAccounts() and
  migrateLegacyContextIfNeeded() now no-op while the identity scope is
  unresolved; reloadForCurrentIdentity() re-runs both once a scope
  resolves, so nothing is lost, and nothing synthesizes accounts or
  queues uploads under a namespace that answers to no one.

- Fence the reload gap. Between a scope change and this manager's
  observer reloading, namespace already names the new identity while
  memory still holds the old snapshot. loadedNamespace records what
  memory belongs to; save(), the stored-context flag, and every
  coordinator path that builds, enqueues, applies or confirms
  account-category records refuses when it mismatches. Staged
  downloads stay durable and re-apply after the reload.

- Tie confirmations and conflict retries to the identity that sent
  them. Every outbound account-category record carries an
  identityNamespace field; didSave honours only confirmations whose
  record carries the current identity's stamp, conflict resolutions
  inherit the local record's stamp and are dropped when foreign, and
  a skipped confirmation re-registers the durable outbox so nothing
  strands. The abandoning conflict branches re-register it too.

- Purge the stale blob. Once a scope resolves, the unresolved
  namespace keys and the unresolved credential-fingerprint store are
  removed; the activation-time validators no longer correct the
  context or rewrite the legacy selection from unresolved state.

Hardened through four adversarial review rounds; the last found
nothing.

Yattee/Services/Subscriptions/DataContextValidator.swift

@@ -165,6 +165,10 @@ final class DataContextValidator {
     /// must never reach here — those are all "unknown", and treating them as
     /// removal is how a user loses their selection during a slow sync.
     func correctIfContextRemoved() {
+        // An unresolved identity has not loaded anybody's accounts yet, so an
+        // account "missing" from that state proves nothing — least of all a
+        // deletion, which is the only thing allowed to move the context here.
+        guard accountsManager.isIdentityResolved else { return }
         guard case let .account(id) = accountsManager.currentContext else { return }
         guard accountsManager.account(id: id) == nil else { return }
 

Yattee/Services/Subscriptions/SubscriptionAccountValidator.swift

@@ -117,6 +117,20 @@ final class SubscriptionAccountValidator {
     /// Validates the current account and auto-corrects if invalid.
     /// Call this on app launch and when configuration changes.
     func validateAndCorrectIfNeeded() {
+        // Availability is decided from account statuses, and every status is
+        // "cannot tell yet" while the credential identity scope is unresolved.
+        // This runs on every foreground activation, so correcting from that
+        // would overwrite the user's selection with `.local` on a state that
+        // was never an answer. The observation loop re-runs when the scope
+        // resolves and the statuses become real.
+        if accountsManager?.isIdentityResolved == false {
+            LoggingService.shared.debug(
+                "Leaving the subscription account alone — the credential identity is still unresolved",
+                category: .general
+            )
+            return
+        }
+
         guard !isCurrentAccountValid else {
             LoggingService.shared.debug(
                 "Current subscription account is valid: \(settingsManager.subscriptionAccount.type)",