bregctl dev rehearsal refuses a bound dev client with extra scopes without naming the cause

Found while writing the public tutorial `Review BReg changes in Casework`.

## What Happened

A `dev-clients.yaml` client bound to an access profile but declaring a scope list different from that profile's (for example the profile's read scope plus a Casework scope) made `bregctl dev` fail its rehearsal with:

```
native schema-test refused: test.step.failed at journeys[0].steps[4]: the fixture authority reference was refused
```

Nothing in the message points at the client, the profile, or the scope difference. Finding the cause took reading the rehearsal source.

## Expected Behavior

Either the rehearsal accepts a client whose scopes are a superset of the bound profile's scopes, or the refusal names the client id, the profile, and the scopes that did not match, and `products/breg/DEV.md` states that a bound client's scopes must equal its profile's.

## Reproduction

`bregctl init --template professional-licences`, add a client with `accessProfiles: []` and `scopes:` listing that profile's scope plus one more, then `bregctl dev `.

## Environment

Registry Stack 0.30.0 release binaries, macOS, OrbStack Docker.

Triage: later.

Riproduci il caso con `bregctl init --template professional-licences` e `bregctl dev ` usando un client associato con uno scope aggiuntivo. Inizia tracciando il percorso di rehearsal di dev che produce l’errore nativo di schema-test, quindi aggiorna `products/breg/DEV.md` se necessario; il lavoro è completato quando il mismatch degli scope viene accettato oppure segnalato insieme al client, al profilo e agli scope differenti.

Scritto dal modello di indicizzazione a partire dal testo della issue.