Consumer receives bare "Request denied" for all failure modes (locked vault, not found, explicit deny)

## Environment

aac 0.11.0 (3b000d15), bw 2026.5.0, macOS 26.5.1 (arm64).

## Summary

`aac run` / `aac connect` surface every failure as `Credential request failed: Request denied` (exit 4). On the provider side these are distinct conditions with distinct fixes:

- vault locked / provider not ready (LookupResult::NotReady -- auto-denied)
- no credential matching the query (LookupResult::NotFound -- auto-denied)
- operator pressed deny

From the consumer (often an unattended agent or CI job), these are indistinguishable, which makes automation around aac hard to debug.

## Suggestion

Add a reason code to CredentialRequestReply -- at minimum distinguishing "provider not ready" from "denied". If disclosing item existence to a paired device is a concern, even a two-state split (not_ready vs denied) plus distinct exit codes would remove most of the debugging pain.