v6.19.0

Auto-released from merge of PR #1767 (trigger: push).

• A replica no longer refreshes with a token its peer already rotated (#1733). The lock service kept a refresh's credentials for 5 minutes, and replicas tick on their own 15-minute phase, so a replica that came back later took the lock and got invalid_grant. Both bundled lock services now keep them for 30 days and serve a read-only POST /lock/<alias>/peek; every instance checks it at startup and on each tick before deciding to refresh. A newer login always beats an older one, so a re-login on one replica is never overwritten by another still holding the old grant. The same order applies when an instance adopts credentials, mirrors login into credentials.json, and reconciles the two at startup. Rebuild the Redis image or redeploy the Worker to get the fix.
• A refresh waits out a lock-service outage while the token has time left. With the lock service unreachable, dario now puts the refresh off to a later tick while the access token has more than 20 minutes left, and refreshes on its own only inside that. It used to refresh at once.

---

Built + tested + npm-published inline by cc-drift-auto-release.yml on this run — tokenless via OIDC trusted publishing, provenance-attested. See the workflow log for the publish output.