Email sign-up: probe that the address is free, create the local identity, then redeem the access
code. Probing comes first because redemption rejects a taken address and an identity created
before that rejection is stranded — it cannot be bound to any account.
ensureIdentity is injected so the caller's operation invoker creates the identity (firing
IdentityCreated, which provisions the identity's spaces).
Email sign-up: probe that the address is free, create the local identity, then redeem the access code. Probing comes first because redemption rejects a taken address and an identity created before that rejection is stranded — it cannot be bound to any account.
ensureIdentityis injected so the caller's operation invoker creates the identity (firingIdentityCreated, which provisions the identity's spaces).