feat(identity): reload the identity map without a server restart

[patroza]

Problem

IdentityService read T3_IDENTITY_MAP_PATH once at layer construction and captured
people in a closure. Adding or removing someone required restarting t3code-server.

Change

The map is re-checked on a 60s TTL (IDENTITY_MAP_RELOAD_TTL_MS) and applies in place.
Every read path (getSnapshot, listMapPeople, claim, requireOperateClaim,
resolveByJiraAccountId, isMapEnabled) now resolves a snapshot instead of a captured list.

Polls rather than watches: the map arrives over virtiofs from the host, where inotify
propagation isn't something to depend on. An ino:size:mtime fingerprint avoids
re-parsing an untouched file each TTL. Time goes through Clock, so the TTL is testable.

Safety

Reload can now fail in production where startup could not, so two rules:

1. A re-read yielding no people never disables an enabled map. enabled === false
   turns the operate gate off entirely — a truncated or unparseable file would have
   failed open. The last good map keeps serving, marked healthy: false, and the next
   TTL retries (the fingerprint is deliberately not advanced).

2. requireOperateClaim no longer deletes the claim of an absent person. Under
   layerPersisted that eviction is a deleteBySessionId — irreversible. A half-written
   file can parse as a valid map with a subset of people, so rule 1 alone doesn't cover
   it. Refusing operate is the gate; membership is re-checked on every operate, so a stale
   row grants nothing. This is a deliberate behaviour change.

Startup behaviour is unchanged: missing/empty map → feature off, and removing
T3_IDENTITY_MAP_PATH is still how you disable the gate.

Tests

New IdentityService.reload.test.ts, driving real files with TestClock:

• an added person applies after the TTL, and not before it
• an emptied file keeps the last good map, stays enabled, reports healthy: false, and recovers
• a removed person is refused operate while their claim row survives, and works again once re-added

Gates: typecheck, lint (exit 0), fmt:check, full test — 2118 passed / 11 skipped.

Companion

Host-side staging (install in stage-secrets.sh, ops repo) truncates and rewrites in
place, and the guest reads that inode live. Nothing observed it mid-write before; a
reloading server does. An atomic temp+rename there is the other half of this — separate PR.

Targets the fork/identity overlay (PR #250) per AGENTS.md.

🤖 Generated with Claude Code