fix: quarantine retired account identities

[xxvcc]

Summary

• reserve monotonically increasing UID/GID pairs durably before account creation, removing the normal foreground daemon-drain delay without permitting identity reuse
• revoke access immediately and keep the passwd name plus UID/GID in a persistent systemd quarantine until a separate finalizer safely deletes the account
• make registry migration, doctor/status, menu pending recovery, orphan cleanup, uninstall, bilingual documentation, and release notes understand the v5 identity lifecycle

Testing

• go build ./...; go vet passes with ordinary and integration tags
• gofmt -l . is empty
• Ordinary and race tests pass
• Integration and integration-race tests pass serially in an isolated Debian 13 systemd container
• Staticcheck (ordinary and integration tags) and govulncheck ./... pass

Release/install scripts, if changed:

• bash -n scripts/*.sh, sh -n scripts/install.sh, and shellcheck -S warning scripts/*.sh
• python3 -B -m unittest -v scripts/mirror_receiver_test.py
• Invalid version/tag rejection and static amd64/arm64 builds pass

Workflows, if changed:

• actionlint

Documentation, if changed:

• Chinese and English user documents remain synchronized and all relative links resolve

Safety Notes

• No real private keys, invite bundles, hostnames, server IPs, /etc/shadow data, or production authorized_keys were committed.
• User/account/sudoers/systemd behavior was tested in a disposable environment.

Canary evidence: generated-account creation returned in 4.801 seconds; menu revoke returned in 0.773 seconds, blocked SSH and removed sudoers immediately, retained the exact identity through quarantine, and the persistent finalizer removed the account, Home, mail, registry row, units, and timer stamp. Final doctor returned 0.