[iuyo5678]

New and upgraded unpaired profiles connect directly through the existing business handshake, including to pre-pairing daemons. There is no authentication probe or retry/fallback state machine before ordinary unpaired use.

Profiles with an active key or saved recovery candidate must authenticate; old-server replies, unknown identities, bad proofs and connection closure never automatically downgrade them. Rejected/expired unused links preserve the current connection. Explicit skipping remains a separate user action. Strict daemon rejections are surfaced as pairing-required instead of an optional warning.

This is the 0.4.2 pairing implementation. The final cleanup PR removes unused migration fields and startup hooks; they do not grant or deny unpaired access here.

Validation across the final stack:

• Rust workspace: 1,020 passed, one existing ignored; formatting and strict Clippy.
• Extension: 3,570 passed, 363 environment-dependent skips; TypeScript, Biome and production build.
• Five real-daemon tests using the current CLI and published 0.4.1; real Chrome for Testing pairing/navigation smoke.
• The 0.4.2 stage independently passed 131 focused tests, three real-daemon tests, typecheck and Biome.

Stack 5/9; base: #427. Review order: #424 → #425 → #426 → #427 → #428 → #429 → #430 → #431 → #432.