Close identity and adoption holes in credential scoping

Four issues from an external review of the previous commit.

The scope was resolved once at startup, so signing out or switching Apple
account while the app kept running left it pinned to the old identity -
reads and writes would then reach the previous account's retained
credentials, which is the exact leak scoping exists to prevent.
CredentialIdentityScope now observes NSUbiquityIdentityDidChange and
re-resolves.

Legacy deletion authority checked only the instance and the identity, not
the account. On an instance with several accounts, deleting any of them
satisfied the marker lookup and could retire the legacy item another
account had adopted, logging out devices still on the previous release.
The marker's accountID is now required to match.

A first-time resolution that failed (launched offline, CloudKit
unreachable) was never retried, disabling credentials for the rest of the
process. resolve() now retries with backoff, and resolveIfNeeded() runs on
foreground activation.

Adoption re-checked nothing at execution time, so a scoped credential
delivered by iCloud Keychain between rendering the offer and tapping it
would be overwritten with the older legacy secret. Adoption now re-verifies
eligibility and writes with a non-replacing add, leaving a duplicate
strictly alone.

Adds regression tests for the sibling-account deletion and the adoption
race.

YatteeTests/AccountCredentialsTests.swift

@@ -253,6 +253,51 @@ struct LegacyCredentialAdoptionTests {
         identityA.deleteCredential(for: account)
     }
 
+    @Test("Deleting a sibling account leaves the adopter's legacy item alone")
+    func legacyDeletionRequiresAccountMatch() {
+        let service = makeService()
+        let markers = makeMarkers()
+        let instanceID = UUID()
+        let adopter = Account.migrated(from: instanceID)
+        // A second login on the same instance — a fresh UUID, not the migrated one.
+        let sibling = Account(instanceID: instanceID)
+        seedLegacyItem(service: service, instanceID: instanceID, value: "legacy-secret")
+
+        let credentials = makeCredentials(service: service, scope: "identity-A", markers: markers)
+        #expect(credentials.adoptLegacyCredential(for: adopter) == true)
+
+        // Removing the sibling must not retire the secret the migrated account
+        // adopted — old-release devices are still using it.
+        credentials.deleteLegacyCredentialIfOwned(for: sibling)
+        #expect(legacyValue(service: service, instanceID: instanceID) == "legacy-secret")
+
+        credentials.deleteLegacyCredentialIfOwned(for: adopter)
+        #expect(legacyValue(service: service, instanceID: instanceID) == nil)
+
+        credentials.deleteCredential(for: adopter)
+    }
+
+    @Test("Adoption does not overwrite a scoped credential that arrived first")
+    func adoptionDoesNotClobberArrivedCredential() {
+        let service = makeService()
+        let instanceID = UUID()
+        let account = Account.migrated(from: instanceID)
+        seedLegacyItem(service: service, instanceID: instanceID, value: "legacy-secret")
+
+        let credentials = makeCredentials(service: service, scope: "identity-A", markers: makeMarkers())
+        // iCloud Keychain delivers the real credential between the offer being
+        // rendered and the user tapping it.
+        credentials.setCredential("synced-secret", for: account)
+
+        #expect(credentials.hasAdoptableLegacyCredential(for: account) == false)
+        #expect(credentials.adoptLegacyCredential(for: account) == false)
+        #expect(credentials.credential(for: account) == "synced-secret")
+
+        credentials.deleteCredential(for: account)
+        KeychainCredentialStore(service: service)
+            .delete(key: KeychainCredentialStore.legacyKey(instanceID: instanceID))
+    }
+
     @Test("A legacy item replaced by another login survives the adopter's deletion")
     func legacyDeletionRequiresFingerprintMatch() {
         let service = makeService()