fix(auth): confirm passkey operations and preserve safe legacy migration

Fence displayed identity and native prompt generations, classify secret-free outcomes, recover atomic addition receipts without restoring old credentials, and expose truthful own-key verification metadata. Preserve required verifier and enrollment authority boundaries. Include real-store, production browser, native CTAP2 and visible responsive regressions.

Validation: root check/fmt; API 115; passkey security 25; Web unit 712/component 605; auth/entry/activation/hosting browsers; product auth E2E 8 and two explicit browser suites. Server suite: 1262 lib+12 CLI, 3 ignored and 2 environment-specific exclusions. State-name checker retains 15 byte-identical baseline findings; no new exceptions. Physical keys/mobile and hosted CI remain unverified.

web/workspace/test/auth-browser/session-navigation.ts

@@ -431,7 +431,7 @@ export async function sessionNavigation(
     },
   );
   await step(
-    "challenge 401 leaves an authenticated account in place and permits retry",
+    "challenge 401 leaves an authenticated account in place but requires result recovery before another addition",
     async ({ page, go }) => {
       const target = "/account?tab=keys#challenge";
       await go(target, "addition-expired");
@@ -451,7 +451,21 @@ export async function sessionNavigation(
           name: "Add passkey to alice",
           exact: true,
         }).isEnabled(),
-        true,
+        false,
+      );
+      await page.getByRole("button", {
+        name: "Check addition result",
+        exact: true,
+      }).click();
+      await page.getByRole("status").filter({
+        hasText: "addition result is still unknown",
+      }).waitFor();
+      assertEquals(
+        await page.getByRole("button", {
+          name: "Add passkey to alice",
+          exact: true,
+        }).isEnabled(),
+        false,
       );
     },
   );
@@ -464,7 +478,11 @@ export async function sessionNavigation(
       await at(page, "/");
       const wire = await (await page.request.get(`${origin}/api/auth/whoami`))
         .json();
-      assertEquals(wire, { actor: null, session: { kind: "anonymous" } });
+      assertEquals(wire, {
+        actor: null,
+        authentication_reference: null,
+        session: { kind: "anonymous" },
+      });
       await page.evaluate(() => {
         localStorage.clear();
         sessionStorage.clear();