- accountKey() revalidates carried snapshot keys (blank/overlong fall back
  to the snapshot identity instead of reaching dedupe/selection/--account).
- normalizeProvider picks the first validated identity candidate so a
  structured account value cannot mask a valid fallback (new
  firstValidAccountIdentity helper in ProviderNormalizer.js).
- parseOutput screens the provider id inside the per-provider try so a
  throwing identity read drops only its own provider.
- Regression cover: tst_provider_normalizer (carried-key revalidation,
  structured-candidate fallback), static ui-regression pin on the guard
  ordering. CHANGELOG updated.

Co-Authored-By: Claude Code <noreply@anthropic.com>