Cache file content in RawTokenCandidate to avoid double-reading token
files (TOCTOU race between metadata extraction and fingerprinting).
Rename stale test description and add fingerprint fields to test
snapshots so they exercise the same comparison path as production.
- keep headless paste routing aligned with the selected Kiro auth method
- validate local callback replay targets and add prompt cancellation safeguards
- wire IDC params through the dashboard start route and support equals-form CLI flags