Ships #557 to the our./friends.parachute.computer boxes: the invite redeem
now only grants a FRESHLY-CREATED vault (gates on provisionVault.created),
rejecting any attempt to gain access to a pre-existing vault — a cross-tenant
breach Aaron caught walking the flow. Plus vault-name defaults to username.

Tag v0.6.4-rc.2 → npm dist-tag `rc` (not @latest).

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>