fix(desktop): make persona deployment idempotent

[bmurphy201]

Summary

• reuse an active managed identity only when the team, persona, runtime, provider, model, and configuration binding match exactly
• fail closed on ambiguous or mismatched candidates while preserving explicit force-new behavior
• add a locked backend persistence guard for stale or concurrent retries, including rollback coverage

Verification

CI-equivalent full package gates passed:

• frontend: 6,518/6,518
• Rust desktop: 3,197 passed, 19 ignored, 0 failed; auxiliary workspace suites passed
• mobile: 2,121/2,121
• typecheck, lint, format, Clippy, cargo check, production builds, and git diff --check passed

The initial managed-runtime run inherited BUZZ_ACP_SESSION_POLICY=thread, and an untouched emoji prewarm test produced one transient file-level failure. Rerunning with the inherited override removed and then rerunning the complete desktop suite passed.

No live duplicate-cleanup or identity-archive manifest is included.

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is 779af8886caae1317b4de962082429867ab61503...ce3112de9a2f3013ddba0abb6b7f75207d8f01de.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review ce3112de9a2f3013ddba0abb6b7f75207d8f01de to authorize a new review.
Any previous review applies only to its recorded range.