Follow-ups from #684 (keymanager import passwords): boot-check hardening and test gaps #686

Non-blocking items from the R4 reviews of #684 (Harper APPROVE, Security CLEAR-WITH-P2/P3):

• Any JSON in the keystore folder with a pubkey and a version field counts as corrupt and blocks boot. Require a real crypto object, or check only 0x<pubkey>.json names.
• An unreadable, empty or truncated 0x<pk>.json only gets a warning, and the validator is skipped (types.rs:1239-1241, 1972-1977).
• Cleanup-fsync gaps on partial failure (types.rs:1876, keystore.rs:531-545); a failed fsync replaces the original unlink error.
• The denylist write is skipped if secret removal keeps failing (DELETE does return an error).
• The abandon_staged fsync is untested.
• Permission tests skip when run as root.
• The delete-retry test doesn't assert the denylist.
• The Gloas two-BN test uses a 2-second wall-clock wait.
• B-006 isn't marked in the plan docs.