## Why
An in-flight token refresh or auth reload can outlive a login change or logout. Its result must not overwrite credentials for a different login or restore stale cached auth.
## What changed
- Serialize in-process auth storage reads and writes that participate in credential updates.
- Verify the stored login before persisting refreshed tokens or agent identity records, while allowing older clients to drop login metadata when the refresh token still matches.
- Reject stale auth reload results using generation checks, and invalidate pending reads on logout even when the cache is already empty.
- Keep account grant reads strict when the keyring is unavailable, while preserving ordinary auth fallback behavior.
## Testing
Add regression coverage for stale reloads after logout, login replacement during refresh, legacy metadata loss, keyring recovery with rotated tokens, and refresh persistence failures.
GitOrigin-RevId: 01bce9ddbc3101de868adcda3370fcdc4eb70163
jif
c6e4438a5d