Optionalspec: ClaimSpec
realm, dns (normalised), usernames (lower-cased) and
waitMs (default CLAIM_WAIT_MS, for tests)
a promise of { ok: true, settle(succeeded) }, where
settle(true) releases after the flush and settle(false) at once, or { ok: false, reason: 'used' | 'store', code, what }
Claims every DN and username a create is about to write, all or none, waiting up to
waitMsfor a value another request holds.