fix(keychain): recover transient session reads

[hubab1]

Summary

• classify Keychain reads as success, missing, transient failure, or terminal failure
• retry only transient Apple Ads session reads at explicit user or service action boundaries
• keep passive UI reads side-effect free and preserve stored credentials on recovery failures
• carry recovery into manual, bulk, and headless refresh paths
• redact Keychain item identifiers from diagnostics and bound bulk workflows to one recovery read

Verification

• 37 focused AppServicesDependencyTests passed
• 620 full tests passed across 54 suites on current main
• Swift 6.2 complete strict-concurrency build passed
• git diff --check passed

The automated suite simulates locked/unavailable Keychain status codes. It does not lock the user's real login Keychain.

Attribution

Recovery behavior was independently implemented after reviewing Felix Lisczyk’s fork commit b05eb34. This version narrows retries to explicitly classified transient Keychain statuses and redacts item identifiers. No commits were cherry-picked.