Settle whether the two strategies share one realization interface #525

Item 5 of 6.1's Open design work, still open.

ProcessSpawn (sudo / runas / UAC) and IdentityAssumption (JIT token minting) differ in almost every
respect: one spawns a process and carries no credential, the other mints a short-lived token and touches no
process.

6.2 sharpens it: ProcessSpawn reduces to "acquire from the pool
with an elevated identity", which is barely an interface. That argues for the split — but it should be
argued, not defaulted into.

Epic: #520 · Feature: #521