refactor(initcmd): share the apply-planned-writes tail (477.5)

[rianjs]

Closes #477 — step 5 of 5, completing the approved Candidate 1 from the design record.

Deduplicates the init application tails, only where they were genuinely identical: initApplicationPlan + applyInitApplicationPlan now own the shared mutation sequence for both the interactive session commit and non-interactive init — validate, group/open/preflight/write credential bundles, save config, then delete stale reviewer keys. Path-specific concerns (non-interactive API-key checks, overwrite policy, primary-store reuse, interactive summaries, readiness output, results, hints) stay at each call site.

The two design-record decisions

• Cleanup primitive stays in initcmd. Moving it into internal/credentials would have required replacing the existing initStore test seam with concrete *credstore.Store plumbing or a new port interface — exactly what the design record said not to introduce.
• The ordering invariant is now pinned in both directions: the save-failure test explicitly rejects any delete call (old credentials intact), and new cleanup-failure coverage proves the config remains saved, partial cleanup is reported, and the error text is byte-exact to before.

Verification

Zero tests deleted; one strengthened, one added, fake store gained a delete hook. Seven config-show goldens unchanged and passing. go build, go vet, full go test ./... green unsandboxed (60 packages), repo-wide golangci-lint 0 issues, architecture harness pass. Production +102/−94 (net +8); +80 test lines.

The full #477 arc

1. test(configcmd): byte-exact config show --json goldens (477.1) #495 — byte-exact config show --json goldens (the safety net)
2. refactor(config): remove leaf compatibility aliases (477.2) #496 — leaf aliases removed (Label, DesktopAccountID, Keyring)
3. refactor(config): remove credential-location aliases (477.3) #503 — credential-location aliases removed (CredentialRef ×4, Profile.SecretsStore), net −229
4. refactor(credentials): extract pure credential-mutation planning (477.4) #504 — pure credential planning extracted into internal/credentials
5. this PR — init apply-tail dedup