fix(mobile): keep retired sections manager out of successor cache

[wpfleger96]

Follow-up to #7806.

• A retired sections manager never writes the shared prefs cache. _persist() now returns once the manager is disposed. That covers every path a torn-down manager could take after an account or relay switch, including a late OK restoring its submitted layout and the dispose() flush's read-before-write merging a head. Before this change, both could overwrite the successor's cache on the same pubkey key.
• Coverage:
  • a retired late OK and a retired flush pre-read both leave the successor's cache untouched
  • an edit made while an OK is held still publishes after the OK is released (_lastPublishedStore is built from the submitted store)
  • a same-second losing head adopted after a local edit still converges UI, cache and relay once our OK wins. The adopted layout's pending debounce is deliberately left armed, because its republish is what re-converges this race.

Residual: an edit made just before our own echo arrives can be replaced by that echo. This is existing behaviour on main and on desktop.

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is 797012ff01a6d499959b45ed2e56f7927c6a4d6b...9a75f5432f07a8ada0818245c84477242632c59f.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 9a75f5432f07a8ada0818245c84477242632c59f to authorize a new review.
Any previous review applies only to its recorded range.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Review clear

HEAD 9a75f5432f07a8ada0818245c84477242632c59f; BASE 797012ff01a6d499959b45ed2e56f7927c6a4d6b. No actionable blocker found in this two-file fix. This is a comment, not merge approval.

• The central persistence guard prevents a retired manager from initiating preference writes after disposal, including late relay OK restoration and the dispose-flush history continuation. I traced provider replacement, startup/resume reads, live callbacks, local edits and publish completion through the shared pubkey-keyed storage boundary. Active-manager persistence and existing relay-flush behavior are preserved.
• The two retirement regressions exercise the production manager, signing/session path and storage with held history/OK responses, then verify the successor’s cache survives. The additional edit-during-OK and same-second convergence tests cover adjacent behavior. The latter establishes convergence, not preservation of every intervening local edit; the documented own-echo residual is unchanged and outside this fix.
• Existing CI passed: mobile analysis, 2444 Flutter tests (4 skipped), and 3 push-unconfigured tests. Evidence is for synthetic merge 6ff82c9a435cf32ed556d3400efb3cc43fba4f8d of this exact head/base. Codex Security Review was cancelled, leaving the commit rollup red; resolve or explicitly disposition that separate gate before merge. No cancellation cause inferred.

Source-only review on pinned Blox2933794; no checkout, local tests, runtime probe or CI rerun. This guard does not add a durability/completion fence for preference writes initiated before disposal, or cancel inherited relay-side flushes.