Prefer JailConfig.name when resolving tenant provisioning targets, parse Bastille root paths only as fallback, and refuse vault provisioning when the spawned jail root differs from the registered tenant root.\n\nTests: cargo fmt --check --package colibri-daemon; cargo test -p colibri-daemon -p colibri-store
