[pkg] comment-only oauth_group terminology touch-up (seatassign package name
kept — its API is generic).

Refs:
- oauth_group rename plan (why seatassign kept): https://github.com/aikeylabs/roadmap20260320/blob/b8f2ab45258cc310f3b90eb03b6b931dcf8e66c6/技术实现/阶段7-企业生产版/20260626-oauth_group-重命名重构-分阶段实施计划.md

…to-seat-group

# Conflicts:
#	seatassign/seatassign.go

Merge develop-1.0.3 into seat-group (seatassign lineage reconcile)

…andoff, install entry unification

new routingwire shared module — single wire contract for GET /accounts/me/routing (control-master emitter ↔ proxy consumer), replacing comment-enforced "seat|group" string keys that drifted silently

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…awned CLI children

On Windows a console-subsystem child inherits the parent's console when
one exists but CREATES a visible cmd / Windows Terminal window when the
parent is console-less. Our Go services run console-less on the main
user path (`aikey web start` uses DETACHED_PROCESS), so every web-bridge
`aikey.exe _internal ...` spawn flashed a terminal window over the SPA —
one per vault-page request (reported live 2026-07-07).

Standard build-tag file pair + per-platform tests, mirroring the
perm_/signals_ pattern. Unix is a strict no-op (asserted: must not
allocate SysProcAttr, so callers' own setsid attrs can't silently merge).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…point)

icacls is a console app; every EnforceOwnerOnly call from a console-less
parent (aikey-proxy startup / WAL init — 5+ call sites across
observability and events) flashed a terminal window on the user's
desktop. Fixing the single runIcacls choke point covers all callers.
Same class as the 2026-07-07 web-bridge window-flash bug; found by the
lateral sweep.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>