v2.63.20

• Make provisioned scope assignment atomic
• Move the provisioned scope check into users.Storage.SaveProvisioned so the lookup and save occur under a single lock
• Prevent concurrent provisioning of usernames that normalize to the same home directory
• Simplify CreateUserHome to only derive and create the home directory
• Add concurrent provisioning tests covering signup, proxy auth, and hook auth
• Cover the case where explicitly assigned (non-derived) scopes are intentionally shared
• Use aria-selected where appropriate
• Full Changelog: v2.63.19...v2.63.20