Daemon cannot read tokens on WSL NodeLink

On a Windows node with a NodeLink mounted at `{jaah-home}\auth\.shared`, the share is a symlink to `\\wsl.localhost\jaah-engine\run\jaah-nodelinks\<id>`, visible only to the runner account `jaah` (WSL distros are per-user). A Claude login runs as `jaah`, writes `.shared\<slug>\.credentials.json` and reports success, but the daemon (`NT SERVICE\jaahd`) cannot see it, so the account shows "OAuth token rejected on <node>" and dispatch falls back to a token-less dir ("no candidate ... presented a credential file"). Found on prod node win1 (BusinessQlik, account nm43q2), Task 8747; worked around by detaching the NodeLink from that node. Requirements: - On Windows, every daemon read, refresh or write of an account token under the token root (collector quota ladder `_claude_account_quota_ladder`/`_refresh_oauth_token`, `shared_storage.token_dir`'s "store holds a credential" test, `fleet_dispatch` credential selection, Codex equivalents) goes through the runner account (session_user seam), as `accounts._delegated_credential_written` already does for the login check. - A login must never report success for a credential the daemon cannot read: verify with the same reader dispatch and the quota probe use. - The console must not call a missing or unreadable credential "token rejected": say the node cannot read the account's credential, and where it looked. - Regression tests in the faked-Windows suites, plus a real Windows node check: sign an account in with a NodeLink attached, see quota read and a runner start. Out of scope: macOS/Linux token handling (unaffected).

Windows daemon now reads NodeLink tokens via the runner account (dispatch, Codex, quota probe); login fails if dispatch can't read it; console says "can't read credential" + path. PR #6584 merged (e9e7214), dev deploy green. Real-node check deferred: draft Task 8875.