caa022faba
The bound-credential discard and the CIMD keep-but-rebind case were spelled out inline where PRM names the issuer, and only the former where the issuer is first learned from AS metadata on the legacy no-PRM path. One method now applies both rules wherever the issuer becomes known, so a CIMD record's carried-over tokens are dropped on that path too. A unit test covers it.