[AUD-D03] Define strict behavior when all accounts are unavailable in hybrid selector

[ndycode]

Deferred Audit Finding

• Finding ID: AUD-D03
• Severity: P2 (selection policy consistency)
• Target milestone: next patch release

Problem

Hybrid selector currently may return an unavailable account when all are unavailable. Policy intent should be explicit and consistently enforced.

Scope

• Decide policy: strict null fallback vs current LRU fallback
• Align rotation.ts, accounts.ts, and request traversal with that policy
• Add/adjust regression tests to codify the chosen behavior

Acceptance Criteria

1. All-unavailable behavior is explicit and deterministic.
2. Selection + request flow semantics are internally consistent.
3. Tests clearly encode expected fallback behavior.
4. Full validation gate remains green.