Implement secure single-instance and next-instance activation

## Objective

Implement the approved single-instance model and activation handoff with clear application identity, user/session boundaries, path/version behavior, race handling, argument transport, focus/activation policy, failure recovery, and security. Account for existing reports such as #11232, #11365, #8441, #4805, and #3296.

## Completion guidance

- Keep the implementation focused on the objective while allowing the assignee to improve the approach based on research.
- Document important decisions, rejected alternatives, dependencies, and follow-up work.
- Add or update tests and documentation appropriate to the work.
- Verify locally and in CI where the task changes code or generated artifacts.

Start by reviewing the objective and the existing reports referenced in issues #11232, #11365, #8441, #4805, and #3296; no source files, tests, or entry points are named. Done means implementing the approved model, documenting decisions and follow-up work, adding appropriate tests and documentation, and verifying locally and in CI.

Written by the indexing model from the issue text.