leora/fix-r6-r7-r8-cas-rekey-bootstrap
sigil-initial
claim_code now requires redeem_expires_at > now in the CAS UPDATE. enrol_rekey shares the enrol: rate-limit bucket. spend_bootstrap and sibling clear delete rows instead of retaining spent hashes, matching the schema comment.