Hold selected-account use leases for desktop provider lifetime #720

Summary

The desktop provider launch path does not register the selected account as actively in use. Account replacement/deletion can therefore proceed while the launched child still uses the earlier account incarnation.

Evidence and reproduction

On main fa0c79b9ae38eca2c59b2b1911becfe1a6b3c9ab, account-manager/src-tauri/src/commands.rs:278-308 obtains selected metadata, starts the provider, and moves only the child into a reaper thread. Neither this path nor account-manager/core/src/providers/mod.rs:368-423 acquires or retains a selected-use lease.

The required atomic validation/acquisition already exists at account-manager/core/src/account_authority/registry.rs:466-509; active-use barriers are implemented in use_lease.rs:143-199. Observation holds a lease (providers/observe.rs:43-46), and the root Grok launch retains one (src/account_authority/grok.rs:283-308). account-manager/docs/MACO_INTEGRATION.md:153-162 requires the lease throughout account use.

A placeholder fixture can block a launched child at a barrier, attempt account replacement/deletion, and observe that the desktop path has no active-use lease blocking the mutation.

Acceptance criteria

• Freeze and atomically validate the exact selected authority/account/incarnation binding before resolving launch material.
• Hold its use lease until child exit, including spawn-failure and reaping paths.
• For socket-backed desktop mode, keep the operation/lease owned by the authority service or use a closed operation-handle protocol; a metadata fetch alone is insufficient.
• Test in-process and socket-backed launches with barriers: replacement/deletion refuses while the child lives and succeeds after confirmed exit.
• Preserve future-selection changes that do not replace active account material.

Scope and verification

Source-level concurrency-contract finding; no live account or credential experiment was performed. Distinct from #409/#582/#601/#662 foundations and #616/#693 provider qualification. No current open Issue/PR covers the desktop lease omission.