Casework task grants: add refusal test coverage

Follow-up to #1029.

Task grant refusal paths in `registry-casework` that have no test:

- [ ] Unknown grant id at `GET /v1/task-grants/{grant_id}/status` and at `POST /v1/task-grants/{grant_id}/assertion` returns 404, never `{active: false}`
- [ ] A status caller that is not listed in `status_clients` gets 403 (the existing case is registered for a different resource, so it only reaches the 404 path)
- [ ] An agent assertion token at the status route, and a service status token at the assertion route
- [ ] A revoke that lands during the source read in `active_task` (the re-check after the read; the existing slow-source test covers only the deadline half)
- [ ] Two approvals of the same proposal in parallel, with the same idempotency key and with different keys
- [ ] An assertion for a grant past its deadline but not yet invalidated gets 403 (only the status side of expiry is tested)

Start in the registry-casework handlers for the status and assertion endpoints, and review the existing slow-source test for the active_task re-check. Add coverage for each listed refusal and concurrency path, including both idempotency-key cases; done means the expected 404, 403, and race outcomes are asserted.

Written by the indexing model from the issue text.