Task grants: remove the registry_grant_authority claim #1039

Follow-up to #1029. Nothing is in production, so this is a hard cut with no compatibility path.

registry_grant_authority gives no protection that registry_grant_source_issuer does not already give:

• ThunderID sets the source issuer from the verified iss of the exchanged assertion and overwrites any value the signer supplies (the spoof case in crates/registry-thunderid-tooling/examples/contextual-exchange.rs). It is the only grant claim the signer cannot choose.
• The signer chooses the authority, so it cannot prove more than the issuer that signed it. Casework has one task_authority.id per deployment, so authority and source issuer are always one-to-one.
• Evidence requires the authority to equal the matched authority-profile identifier, so Casework's configured id must spell an Evidence profile name. A mismatch surfaces only as a generic denial.

Do this before writing the authority test items in #1030, #1032 and #1033.

• registry-platform-oidc: remove the member from ClaimNames, GrantClaims and the core grant member set
• registry-thunderid-tooling: remove it from GRANT_ATTRIBUTES
• Casework: stop emitting it in the task assertion; task_authority.id stays an internal label or goes
• BREG: an access profile's taskGrant keeps sourceIssuer only; key TaskGrantStatusRegistry by source issuer; keep sourceIssuer in audit; regenerate the runtime schema
• Evidence: match an authenticated-grant authority profile by grantSourceIssuer, requesterClients, purpose and requirement, all already checked in task_grant_matches (an ambiguous match is already refused). Remove grantAuthority from the selector source in authority-context.schema.yaml and from its authenticated_grant_rule, from the claim names in bundle.schema.yaml, and from CONFIG.md via check-config-key-paths.sh --write. bundle.schema.yaml is a frozen grammar, so align the Version 1 contracts and V1-I07 in the same change
• registry-evidence-oid4vci: remove the claim name from its configuration
• Fixtures, bregctl / caseworkctl / evidencectl dev configuration, and docs that name the claim