fix(auth): confirm passkey operations and preserve safe legacy migration

Fence displayed identity and native prompt generations, classify secret-free outcomes, recover atomic addition receipts without restoring old credentials, and expose truthful own-key verification metadata. Preserve required verifier and enrollment authority boundaries. Include real-store, production browser, native CTAP2 and visible responsive regressions.

Validation: root check/fmt; API 115; passkey security 25; Web unit 712/component 605; auth/entry/activation/hosting browsers; product auth E2E 8 and two explicit browser suites. Server suite: 1262 lib+12 CLI, 3 ignored and 2 environment-specific exclusions. State-name checker retains 15 byte-identical baseline findings; no new exceptions. Physical keys/mobile and hosted CI remain unverified.

web/workspace/test/activation-browser/fixture-server.ts

@@ -41,6 +41,7 @@ Deno.serve({ hostname: "127.0.0.1", port: Number(port) }, async (request) => {
   if (path === "/api/workspaces") return new Response(null, { status: 503 });
   if (path === "/api/auth/whoami") {
     return Response.json({
+      authentication_reference: mode !== "anonymous" ? "fixture-authentication" : null,
       session: mode !== "anonymous"
         ? { kind: "authenticated", expires_at: "2099-01-01T00:00:00Z" }
         : { kind: "anonymous" },
@@ -89,7 +90,7 @@ Deno.serve({ hostname: "127.0.0.1", port: Number(port) }, async (request) => {
     if (mode === "activation-unknown") {
       return new Response(null, { status: 503 });
     }
-    return Response.json({ user });
+    return Response.json({ user, authentication_reference: "fixture-authentication" });
   }
   if (path.startsWith("/api/")) return new Response(null, { status: 404 });
   const file = join(root, decodeURIComponent(path));