Recover the current identity of an Accounts-owned enrollment

Default off. Accounts authorizes the current owner/admin of the exact existing Commerce workspace and signs a command. Core checks current Accounts JWKS and the SYNCED human workspace projection; no org, membership, merchant ADMIN key or Marketplace purchase is created. A command lease lasts at most 30 seconds, with at most 5 seconds future clock skew. JSON only; no query, Origin or Cookie. command_id has immutable semantic content; retries may refresh only issued_at and authorization_expires_at. No route executes a commerce or payment transaction. Requires current workspace owner/admin and exact retained enrollment_id, without an old Microsoft proof or known connection ID. Recovers pending, active or revoked records. Historical provider observation time/guard flags never become fresh evidence. read_granted is computed from current persisted enrollment/grant and managed assignment eligibility; unavailable assignment authority reports false. No permission is created or renewed.