feat: adopt Enbox 0.8.29 and single-flight session setup

[LiranCohen]

Summary

The wallet's complete response to the sync-chattiness investigation, in two complementary halves:

Enbox 0.8.29 release adoption (agent 0.8.29, api 0.6.67, auth 0.6.75, browser 0.3.59, connect 0.1.10, dwn-clients 0.4.21, dwn-sdk-js 0.4.14, protocols 0.2.94) — the transport/sync-layer fixes arrive through the wallet's existing integration with no code changes:

• Wake-responsive WebSocket recovery — the connection pool registers browser online/tab-visible listeners itself, force-probes socket liveness on wake, and fast-forwards reconnect backoff, replacing the 60–100s dead-socket blackouts observed in the HAR.
• Coalesced recovery checks — overlapping wake signals collapse into one integrity check with a cooldown and single trailing follow-up; brief tab flips are ignored. Eliminates the duplicate full sync waves per tab focus.
• Single-socket endpoint ownership with subscription preservation — reconnect races leave exactly one live socket; subscriptions transfer with cursor continuity, close handles stay valid across re-establishment, and unrecoverable subscriptions surface a terminal SubscriptionRecoveryFailed error instead of a silent gap.
• Lossless encrypted-subscription backpressure — acks and reconnect cursors advance only after decryption and consumer processing; overflow terminates losslessly with a replayable cursor. Security-relevant for revocation and key-delivery subscriptions.
• Faster failure semantics — requests against closed/reconnecting sockets fail fast; the server terminates dead peers immediately.

Single-flight session setup (from #178) — the wallet-side half of the same investigation, fixing the duplicated startup traffic the HAR showed (every DID registered twice per endpoint):

• join concurrent identity sync setup by agent and DID
• join concurrent tenant registration by agent, DID, and endpoint while preserving retries after completion or failure
• avoid repeating first-connect post-session registration already performed by connectVault
• focused concurrency and provider-flow regression tests

Test plan

• bun install (lockfile updated for the new release set)
• bun run lint (0 errors; pre-existing warning set unchanged)
• bunx tsc --noEmit
• bun run test (753 passed, 10 skipped — includes the new single-flight concurrency tests running against 0.8.29)
• bun run build
• bun run test:e2e (28 passed, isolated from other local dev servers)

🤖 Generated with Claude Code

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🟢	Lines	68.86% (🎯 25%)	3452 / 5013
🟢	Statements	66.83% (🎯 25%)	3649 / 5460
🟢	Functions	65.23% (🎯 30%)	1051 / 1611
🟢	Branches	62.91% (🎯 29%)	2285 / 3632

File Coverage

File	Stmts	Branches	Functions	Lines	Uncovered Lines
Changed Files
src/enbox/identity-sync.ts	85.96%	68.75%	82.6%	85.96%	29, 57, 101-114, 148
src/enbox/provider.tsx	79.01%	49.35%	73.68%	81.95%	68, 81, 124, 182, 189-190, 197, 207, 215-216, 227, 233, 250-261, 267, 271, 282, 292, 335, 344, 359-364, 378, 402-407, 416-431, 440, 445-446
src/enbox/registration.ts	63.63%	54.05%	57.14%	65.88%	32, 37-102, 126, 136-140, 187, 201, 215-219, 242-248, 253
src/enbox/effect/keyed-single-flight.ts	100%	83.33%	100%	100%
src/enbox/mutations/identity-mutations.ts	73.82%	60.86%	70.93%	73.82%	59, 66, 88, 93, 98, 132-133, 150-160, 344-345, 393-398, 427-433, 441-450, 471-517, 591-596, 619-624, 636

Generated in workflow #421 for commit 2f29efa by the Vitest Coverage Report Action