ThunderID tooling: refuse static human actor kind on machine clients, image pull timeout, test JWKS

Follow-up to #1029.

- [ ] `protected_attribute` in `crates/registry-thunderid-tooling/src/description.rs` reserves the grant claim names, but a hand-written issuer description can still give a client-credentials client a static `registry_actor_kind: human`. `caseworkctl dev` refuses this; the general validator does not. Refuse the value `human` on client-credentials clients (agents keep `agent`).
- [ ] The first command that needs the pinned image is the database schema seed, which runs under the 120 s `COMMAND_TIMEOUT` in `local_session.rs`. On a cold image cache the pull is killed and reported as "the shipped database schema could not be seeded". Pull the pinned image as its own step with a longer timeout, or say in the error that the image may still be downloading.
- [ ] The test JWKS in `testing.rs` has 44-character P-256 coordinates (33 bytes). P-256 coordinates are 43 characters (32 bytes).

Start with crates/registry-thunderid-tooling/src/description.rs, local_session.rs, and testing.rs, then inspect the existing validator, image-seeding flow, and test JWKS coverage. Done means client-credentials descriptions reject a static human actor kind, image preparation no longer fails prematurely or reports misleadingly, and the P-256 test coordinates have the correct length.

Written by the indexing model from the issue text.