Close the review's gaps round the agent account (hq ADR 0266)

The managed settings apply to every account's claude, so a key-helper script under the
agent's home would run as the operator, and through sudo as root: the command is now
carried whole in the root-owned managed settings and reads the key only as the agent.
The helper reads only a regular file, bounded, without blocking, and a request it does
not answer fails in time instead of holding every later one; a directory entry it
answers that is not a name is refused. The guard's record is matched on its binary in
the query, a half-named agent account is not taken as the operator's, the kept API key
stays until the agent's home holds one, restic refuses to restore beside a directory
others may write, and the agent-home check cleans a path before judging it.

modules/claude-code/cmd/claude-code/agent_account.go

@@ -80,6 +80,10 @@ func RetireOperatorHome(p Paths) []string {
 	}
 	for _, name := range []string{"api-key", "api-key-helper"} {
 		old := filepath.Join(p.State, name)
+		if name == "api-key" && !holdsApplied(p, "api-key") {
+			// Kept, like the token above, until the agent's own home holds the key.
+			continue
+		}
 		if _, err := os.Stat(old); err == nil {
 			if err := os.Remove(old); err == nil {
 				out = append(out, "removed "+old+": the key and its helper are kept where "+p.Agent+" reads them")