Plan duplicate-name cleanup and enforce owner-scoped uniqueness #122

Delivered

Agent names are normalized with trimming, Unicode Form KC and invariant casing. Active names are unique per owner, while different owners may use the same display name. Manual creation, owner rename and OAuth consent share the same validation, and a filtered database constraint protects concurrent workers.

Fresh OAuth authorization creates a distinct Agent and lets the human replace the client-suggested name. Connections are attached to an existing identity only through explicit identity selection, never by matching names.

When the final credential is deleted, the identity is retired: it no longer reserves its former name, while immutable Agent IDs/public references and historical task and memory attribution remain intact. The migration retires existing credential-less identities without merging identities, transferring permissions or rewriting provenance. Active identities remain visible and owner-renamable. The obsolete Agent identity names / Review names UI was removed by owner decision; #191 records that superseded review path.

Acceptance

• Same-owner normalized duplicates are rejected; different owners may reuse names.
• Database constraints protect creation and rename races.
• Existing credential-less identities are migrated to the explicit retired lifecycle with rollback metadata.
• Deleted identities release names without credential, permission or provenance transfer.

Evidence

Implemented and deployed in ee81296, e9e0a52 and 741c845; lifecycle coverage added in af19965. Full Web test suite: 63 passed, 0 failed.