feat(oidc): a kept identity taken in the host's transaction, and told kept without taking it

`takeKept` takes a `transaction`, so a host's step that fails (a name
taken meanwhile) gives the identity back instead of losing it; `isKept`
tells whether an identity waits under an attempt for its caller, so a
host can check before asking more of the person.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_oidc_server/README.md

@@ -121,8 +121,11 @@ the host's library; the package's main library is the code generator's):
   (`VerifiedOidcIdentity`: the provider's key, the `sub`, the claims, the caller),
   touching no account.
 - `keep(session, attempt:, identity:, keepFor:)`: the identity kept that long under the
-  attempt's ID, which `takeKept` takes once, as when a person chooses a name before their
-  account is made.
+  attempt's ID, which `takeKept` takes once (in the host's transaction if given, so a
+  step of the host's that fails gives it back), as when a person chooses a name before
+  their account is made; `isKept` says whether it is there without taking it. Kept with
+  a person as its caller, it stands for a sign-in of theirs just made, for a host that
+  asks for one before a change.
 - `accountOf`, `hasIdentity`, `link`, `unlink`: the identities.
 - `forgetExpiredAttempts`: `begin` forgets them on the way; call it daily as well.