test(16.3-04): full Go coverage for tokens, guard, account API and CLI

Pin bouncer Scope serialization, party Activated order, lagoon migration,
compile/overlap/mint/expiry/validation, guard/debounce/resolver,
interactive-only, account token API and CLI on Postgres.

Co-authored-by: Cursor <cursoragent@cursor.com>

modules/party/registry_test.go

@@ -325,6 +325,28 @@ func TestActivatePublishesPlugins(t *testing.T) {
 	}
 }
 
+func TestActivatePublishesActivatedOrderAndRefusesSecond(t *testing.T) {
+	var log []string
+	a := &tracePlugin{id: "golem15.a", log: &log}
+	b := &tracePlugin{id: "golem15.b", req: []string{"golem15.a"}, log: &log}
+	app := backpack.New(&compass.Config{})
+	ordered, err := activate([]Plugin{b, a}, app, []string{"golem15.b", "golem15.a"})
+	if err != nil {
+		t.Fatalf("activate: %v", err)
+	}
+	if len(ordered) != 2 || ordered[0].ID() != "golem15.a" || ordered[1].ID() != "golem15.b" {
+		t.Fatalf("activation order = %v", ordered)
+	}
+	activated, ok := app.Lookup[Activated]()
+	if !ok || len(activated) != 2 || activated[0].ID() != "golem15.a" {
+		t.Fatalf("Activated = %#v ok=%v", activated, ok)
+	}
+	if _, err := activate([]Plugin{b, a}, app, []string{"golem15.b", "golem15.a"}); err == nil {
+		t.Fatal("second Activate on the same app must error")
+	}
+}
+
+
 func TestRegisterNilIsNoop(t *testing.T) {
 	Register(nil)
 }