fix(auth): confirm passkey operations and preserve safe legacy migration

Fence displayed identity and native prompt generations, classify secret-free outcomes, recover atomic addition receipts without restoring old credentials, and expose truthful own-key verification metadata. Preserve required verifier and enrollment authority boundaries. Include real-store, production browser, native CTAP2 and visible responsive regressions.

Validation: root check/fmt; API 115; passkey security 25; Web unit 712/component 605; auth/entry/activation/hosting browsers; product auth E2E 8 and two explicit browser suites. Server suite: 1262 lib+12 CLI, 3 ignored and 2 environment-specific exclusions. State-name checker retains 15 byte-identical baseline findings; no new exceptions. Physical keys/mobile and hosted CI remain unverified.

web/workspace/test/spa-shell.test.ts

@@ -27,6 +27,7 @@ Deno.test("authentication and hosting shells never require Workspace catalog aut
           display_name: "Alice",
           auth_method: "browser_session",
         },
+        authentication_reference: "fixture-authentication",
         session: { kind: "authenticated", expires_at: "2099-01-01T00:00:00Z" },
       });
     browserSession.invalidate();
@@ -68,7 +69,11 @@ Deno.test("root admission never starts private catalog while anonymous, expired,
         if (condition === "loading") await pending;
         return condition === "error" || condition === "loading"
           ? new Response(null, { status: 503 })
-          : Response.json({ actor: null, session: { kind: condition } });
+          : Response.json({
+            actor: null,
+            authentication_reference: null,
+            session: { kind: condition },
+          });
       };
       let privateCalls = 0;
       const event = {