thunderid-tooling: a collision-free multi-segment scope no longer has a local representation

Raised by review on #1057 (`crates/registry-thunderid-tooling/src/local.rs:84`). Deferred from that PR because it is a consequence of an earlier deliberate encoding choice, not of what #1057 changes.

## What happens

`local.rs` renders a BReg or Casework scope into a ThunderID resource handle plus an action. A scope such as `a:<63-byte segment>:<63-byte segment>` is accepted by the BReg and Casework clients-file validators (it is a bounded RFC 6749 token), but the local render joins every segment after the first into one action, producing a 127-byte action that exceeds the 64-byte action bound. A valid clients file therefore fails to start locally.

## Why it was not fixed in #1057

The flat-resource encoding is a deliberate collision fix with a named test: representing nested scopes as multiple resource handles let two distinct scopes render to the same handle pair. The 64-byte action bound is a direct consequence of that encoding. Reverting to per-segment handles reintroduces the collision; widening the action bound is a change to the ThunderID resource contract. Neither is a change #1057 is making.

## What a fix needs to decide

Pick one:

- **Widen the action bound** to whatever the joined form needs, if the ThunderID side can carry it, and state the new bound in the resource contract.
- **Refuse at clients-file preflight** instead of at local render, so an operator is told at authoring time that the scope has no local representation, with the bound named in the message.
- **Change the encoding** to something that is both collision-free and bounded (for example a length-prefixed join, or a hash-suffixed truncation), keeping the collision test green.

Whichever is chosen, the acceptance test is the scope in the title rendering or being refused with a message that names the limit, plus the existing collision test staying green.

Start at crates/registry-thunderid-tooling/src/local.rs:84 and trace the BReg and Casework local rendering and clients-file validation paths. Compare the three proposed approaches while preserving the existing collision test. Done when the 63-byte multi-segment scope either renders successfully or is refused before local render with the relevant limit named in the message.

Written by the indexing model from the issue text.