[iuyo5678]

Make revocation and replacement complete connection/session cleanup before returning, and serialize them with authenticated registration. Pending calls settle when authorization ends.

Use existing change notifications and device/registry gates; per-connection disk polling and redundant file locking are not retained. Candidate recovery and atomic persistence remain in the stack.

Validation across the final stack:

• Rust workspace: 1,020 passed, one existing ignored; formatting and strict Clippy.
• Extension: 3,570 passed, 363 environment-dependent skips; TypeScript, Biome and production build.
• Five real-daemon tests using the current CLI and published 0.4.1; real Chrome for Testing pairing/navigation smoke.
• The 0.4.2 stage independently passed 131 focused tests, three real-daemon tests, typecheck and Biome.

Stack 4/9; base: #426. Review order: #424 → #425 → #426 → #427 → #428 → #429 → #430 → #431 → #432.