Shared authorization claims: add refusal tests and tighten the claims API

Follow-up to #1029.

Refusal paths in `registry-platform-oidc` (`authorization_claims.rs`) and `registry-platform-audit` (`authorization.rs`) that have no test:

- [ ] Empty or non-string values for each `registry_grant_*` string claim and for `registry_purpose`
- [ ] Over-long values and values with control characters
- [ ] Non-string `registry_actor_kind`
- [ ] Missing `registry_purpose` while the rest of the core grant set is present
- [ ] `verify_context` returning `GrantContextError::MissingVerifiedClient` and `GrantContextError::InvalidVerifiedClient`
- [ ] The audit event refusing with `AuthorizationAuditError::InvalidActorKind` and `AuthorizationAuditError::InvalidCode`

API tidy-ups:

- [ ] `grant_claims` and `actor_kind` take `&Claims`. Take `&VerifiedToken` instead, so unverified claims cannot reach them.
- [ ] Bound the digit length accepted by `valid_key_version`.
- [ ] Document that `verify_context` binds the client and the resource only, and that each product binds the source issuer itself. #1039 removes `registry_grant_authority`, so land it first and do not document or test the authority claim.

Start with #1029 and confirm that #1039 removing registry_grant_authority lands first. Inspect registry-platform-oidc/authorization_claims.rs and registry-platform-audit/authorization.rs, then add the listed refusal tests and tighten the claims API around VerifiedToken. Done means the validation, error paths, key-version bound, and verify_context documentation are covered without documenting or testing the removed authority claim.

Written by the indexing model from the issue text.