fix: harden revoke identity and sudo NSS verification

[xxvcc]

Summary

• bind current-format managed accounts to a protected fifth-field GECOS generation witness
• keep invite creation byte-exact before activation while allowing stable-identity rollback after activation may have begun
• prevent sudo NOPASSWD false positives when NSS stop controls make the local files source unreachable
• document v2.9.4 compatibility and correct the release-keyring explanation

Testing

• go test -count=1 ./...
• go test -race -count=1 ./...
• go vet with ordinary and integration tags
• Staticcheck with ordinary and integration tags
• govulncheck ./...; go mod verify; go mod tidy -diff
• gofmt and git diff checks
• ShellCheck, shell syntax, and 22 mirror receiver policy tests
• static amd64/arm64 release builds with version 2.9.4
• disposable Debian systemd integration, including concurrent chfn/chsh revoke and synchronous uninstall cleanup

Safety Notes

• no release private key, invite bundle, token, production host, or shadow data is included
• privileged account and lifecycle tests ran only in a disposable container
• ARCHITECTURE.md remains an ignored local note and is not part of this PR