fix(workstreams): recover member key initialization safely #937

registry keys member-init creates a member secret inside its SQLite transaction, then removes that secret on every reported transaction error. A durable COMMIT followed by an acknowledgement error can therefore leave an active key row without its key. A crash before COMMIT can instead leave an orphan file that blocks ordinary reruns.

Repair the source path by reconciling the exact relevant row outside a failed transaction: retain the file and succeed only for this attempt's exact committed row; remove only this attempt's unchanged file when row absence is proved; preserve the file and return outcome_unknown on unreadable or conflicting evidence. Add an explicit --resume for valid orphan files and exact row/file no-ops, reject malformed files, and report key_file_missing without regenerating an existing ID.

Acceptance: focused CLI fault-injection and recovery regressions, real member key provisioning in peer-setup integration, server typecheck, and strict Jones boundary validation. Source-only work; no installed runtime adoption or live-state repair is authorized or claimed.