Function ensure_tier 

fn ensure_tier(
    conn: &Connection,
    tier: Tier,
    uid: &str,
    row: &Row,
) -> Result<(UidKeypair, UidKeyOrigin), StoreError>

One tier: the existing UID key, else a copy of the name-keyed key when the evidence holds, else a fresh one. Runs under the caller’s lock.