Keep a validated accountKey beside the collapsed display label so
spacing-distinct accounts stay separately selectable and --account
carries the unmodified name. Selection, matching, scope keys, and the
account picker compare keys; display and subtitles are unchanged.

Bind cached token costs to the command source that produced them: a
source change retires live cost runs and reprojects retained snapshots
synchronously, both cost surfaces refuse foreign snapshots, and parses
stamp their source.

Contain per-provider normalization failures in parseOutput so one
malformed record cannot abort the refresh or stall loading, and read
status fields without coercing objects with a missing toString.