test(tokenstore): pin the warning's stderr default (round-2 review)

Every warning test swaps loosePermsWarnW to capture output, so changing the production default to io.Discard silently deleted the feature while the suite stayed green (the one mutation that survived round-2 review). Also note the once-per-process composition on the dedup field doc.