* test(cache): reproduce quota retention across distinct account keys

* fix(cache): retain quotas only within the same account identity

* fix(cache): keep the verified startup cache within account isolation

Disk cache entries deliberately carry no identity, so the new account-key
gate rejected every identified account during restore instead of telling
two of them apart: an early failed refresh discarded the cached quota and
the following encode erased it. The cache context fingerprint already pins
the selected account for that path, so reconcile now takes a scopeVerified
flag that restore sets, while the live refresh path keeps comparing keys.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(cache): pin the startup cache bypass to verified account selections

The previous commit let every provider skip the account-key comparison
during restore, but usageCacheContext() fingerprints only the explicit
entries of selectedAccounts. A provider left on the CLI default account
can therefore change identity between sessions without changing that
fingerprint, so an early identified failure could reuse the quota saved
for the previous default account. reconcile() now takes the pinned
account map instead of a blanket flag and skips the comparison only for
a provider whose explicit selection the context covers.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>