Sign-in markers: stop mirroring to the legacy shared record one release after #1969 #1970

What to do

#1969 moves remembered sign-in markers from the shared Studio:PotentiallyAuthenticated record to one key per entity (Studio:PotentiallyAuthenticated:<entityId>). Studio tabs from before #1969 read the shared record only at load and write their whole copy back. So for one release #1969 also mirrors every marker change into the old record, and its sign-out sweeps read it. That keeps old tabs, and a rollback, consistent with new ones.

One release after #1969 ships to production:

1. Stop mirroring into Studio:PotentiallyAuthenticated.
2. Delete the old record on load, keeping the one-time migration of anything still in it.
3. Drop the old-record reads from the sign-out sweeps and the Studio:PotentiallyAuthenticatedMigrated flag's special handling, and update DESIGN.md.

Why it can't wait

While the mirror exists, the old record keeps the limits #1969 removed for new tabs. These are the review findings recorded against it:

• a read-modify-write race between tabs on the mirrored record;
• a rewrite per entity during a full sign-out;
• an unreadable record replacing it on write;
• the migration's one-time copy, and an old tab's write-back bringing back a signed-out marker.

Don't remove it until production has run #1969's release long enough that no tab from before it is still open.

Review-Deferral: d861d82357ec0895 severity=minor category=concurrency
Review-Deferral: 58c8df7ce1fb2420 severity=nit category=concurrency
Review-Deferral: 43cd604ec076ea0e severity=nit category=concurrency
Review-Deferral: 81c98bc4312a6a42 severity=nit category=performance
Review-Deferral: 1282fb67a2760cbc severity=nit category=data-integrity
Review-Deferral: a947843f6d1dd466 severity=nit category=correctness
Review-Deferral: defde12cf7a0afc8 severity=nit category=correctness

Raised by the cross-model review of #1969 (#1968).

_{🤖 Generated by Anthropic Claude Code (Claude Opus 5.5); posted via @dawsontoth.}