Harden the service account secret exchange

Check the exchanged token's unverified claims before caching or sending it, and again on every cache read: sub must be the secret's svc_ account, the exchange Core must be its only URL audience, and its exp must not have passed; the earlier of exp and expires_in bounds reuse. Run the exchange and cache write-back under a per-entry file lock, which ForgetServiceAccountSecretToken also takes, so parallel commands share one exchange instead of spending Core's per-secret rate limit. Never follow a redirect on the exchange: a 307/308 would resend the secret in the body. Report credential_source (context, env_token, sa_secret) in auth status --json.

The exchange now runs on an exchangeSubject (subject token and type, account, Core, cache name), so a key-signed assertion can reuse it.