Evidence: unit tests for task grant matching and V1-I07 traceability

Follow-up to #1029.

- [ ] Add unit tests for `task_grant_matches` in `crates/registry-evidence/src/selector.rs`. It is covered today only through `tests/selector_conformance.rs`.
- [ ] V1-I07 in `products/evidence/contracts/security-invariant-matrix.yaml` now lists the full grant binding set (agent kind, principal, client, resource, trusted source issuer, deadline, authority, purpose, requirement bound). #1039 removes authority from this set and aligns V1-I07; land it first so the tests register against the set it leaves. In `security-test-traceability.yaml`, `sec-caller-grant-reference-rejected` still maps only to `request_rejects_query_material_and_unknown_fields`. Register `task_grant_context_is_bound_before_selector_or_source_access` for it as well.

Start with crates/registry-evidence/src/selector.rs and tests/selector_conformance.rs to understand task_grant_matches coverage. Inspect products/evidence/contracts/security-invariant-matrix.yaml and security-test-traceability.yaml, taking the authority alignment from #1039 into account first. Done means unit tests cover task_grant_matches and the specified traceability mapping includes task_grant_context_is_bound_before_selector_or_source_access.

Written by the indexing model from the issue text.