fix(desktop): preserve existing identity onboarding context

[RossHartmann]

Summary

• distinguish upgrade/recovery onboarding from a blank first launch using existing community state
• present the already-loaded native identity as Continue setup instead of implying that a new key will be created
• keep the trust boundary unchanged: legacy or mismatched community state still cannot auto-complete onboarding

Why

After an upgrade that lacks the newer per-public-key machine-onboarding marker, the native layer can successfully recover the existing key while the landing page still says Create a new identity key. The action actually reloads the current identity; the label makes a safe recovery path look destructive.

Validation

• focused machine-onboarding tests: 9/9
• focused Biome check on the four changed files
• downstream protected desktop CI exercises compile, unit, smoke, integration, and release-candidate paths