Expand description
Deduplicate identity accounts that share the same (provider, credential).
Root cause: the old per-channel backfill_shared_store_once ran at every
channel startup and copied the channel’s local account UUID into the shared
store. Each channel had a different UUID for the same underlying credential
(e.g. the shared claude OAuth dir), so the shared store accumulated one row
per channel launch rather than one row per credential.
Strategy: group accounts by (provider, secret_ref JSON). For each group of duplicates, keep whichever account is currently referenced by a direct agent identity link (or the oldest by created_at if none is linked). Reroute any agent identity links that reference a dupe to the canonical, then delete the dupes — the CASCADE FK handles any remaining joins. (Identity bundle bindings were rerouted here too, prior to Phase 4c of SPEC_PRESET_TO_BUNDLE_REFACTOR_2026_07_02.md dropping db_identity_bundles/db_identity_bindings.)