refactor: keep the size, cast and error-code guards where they were

The fixes above grew six files over 800 lines and three long functions, added
casts in tests and one error code the catalogue did not list. The claimable
profile check moves into its own module, the guardian count is reused by the
revoke path, the lifecycle fallback lives beside the lifecycle rules, the
key-needs list is its own component, the coach sweep wraps its filters with
ownedByActiveAccount, comments are tightened, and the test fixtures are typed
instead of cast. The enumeration guard reads a write keyed by one handed id
(id: runId, id: job.data.jobId) as scoped, so those need no marker.
account.deletion.no_guardian joins the catalogue; two baselines go down.

src/__tests__/baselines/source-function-lines.json

@@ -54,7 +54,7 @@
     "components/admin/api-token-overview-section.tsx :: ApiTokenOverviewSection": 212,
     "components/admin/app-log-preview-section.tsx :: AppLogPreviewSection": 341,
     "components/admin/central-codex-section.tsx :: CentralCodexSection": 241,
-    "components/admin/encryption-section.tsx :: EncryptionSection": 303,
+    "components/admin/encryption-section.tsx :: EncryptionSection": 264,
     "components/admin/general-settings-section.tsx :: GeneralSettingsSection": 220,
     "components/admin/glitchtip-section.tsx :: GlitchtipSection": 233,
     "components/admin/host-metrics-chart.tsx :: HostMetricsChart": 232,