fix(auth): require scoped principals for ordinary coordination and audit break-glass

Parent: #384 (P0-2b). Depends on P0-2a PlatformDirectory role SSOT.

## Scope
Ordinary claim/tick/task/verdict operations must use a scoped principal bound to an active Directory identity/role. The ops token becomes break-glass only and must emit a distinct audit event.

## Acceptance
- Ops token self-reporting a production agent on ordinary endpoints returns 403.
- Scoped identity mismatch returns 403; inactive/unauthorized roles return 403.
- Break-glass uses an explicit path/action and records actor, reason, target, time, and outcome.
- Focused gateway tests cover success and all denials.

Delivery discipline: one issue, one worker branch, one PR.

Start with the gateway handlers for claim, tick, task, and verdict, and review the PlatformDirectory role SSOT from P0-2a. Add focused gateway tests covering scoped-principal success, every stated denial, and the explicit break-glass path; done means denials return 403 and break-glass records the required audit details.

Written by the indexing model from the issue text.