persistSigil

Persist the sigil triple atomically — see the class-level "durability contract" KDoc for the .commit() rationale.

Updates snapshotFlow after the on-disk commit so every observer (e.g. WalletPanelViewModel auto-retry) sees the new identity as soon as the next coroutine continuation runs.

Overwrite guard (#15). Writing a triple for a DIFFERENT credentialId over an existing one is refused unless replace is explicitly true — a guard against a forge/restore path silently clobbering a live sigil (one wrong tap = sigil gone). Re-persisting the SAME credential is always allowed (idempotent), so legitimate re-establish flows — sign-in, the reuse branch of establishSigil — never trip the guard. The only intentional replacement today is "start fresh", which passes replace = true.

Throws