bregctl dev rehearsal refuses a bound dev client with extra scopes without naming the cause

Found while writing the public tutorial `Review BReg changes in Casework`.

## What Happened

A `dev-clients.yaml` client bound to an access profile but declaring a scope list different from that profile's (for example the profile's read scope plus a Casework scope) made `bregctl dev` fail its rehearsal with:

```
native schema-test refused: test.step.failed at journeys[0].steps[4]: the fixture authority reference was refused
```

Nothing in the message points at the client, the profile, or the scope difference. Finding the cause took reading the rehearsal source.

## Expected Behavior

Either the rehearsal accepts a client whose scopes are a superset of the bound profile's scopes, or the refusal names the client id, the profile, and the scopes that did not match, and `products/breg/DEV.md` states that a bound client's scopes must equal its profile's.

## Reproduction

`bregctl init --template professional-licences`, add a client with `accessProfiles: []` and `scopes:` listing that profile's scope plus one more, then `bregctl dev `.

## Environment

Registry Stack 0.30.0 release binaries, macOS, OrbStack Docker.

Triage: later.

Reproduce the case with `bregctl init --template professional-licences` and `bregctl dev ` using a bound client with an extra scope. Start by tracing the dev rehearsal path that produces the native schema-test error, then update `products/breg/DEV.md` if needed; done means the scope mismatch is either accepted or reported with the client, profile, and differing scopes.

Written by the indexing model from the issue text.