test: require run-bound session proof at grant join

Description

The pitch.

## Summary

Preserves the absent/wrong-presenter test requirement from legacy #156 (@mwarsss) on current Town Run Grants. The production check already exists; this PR adds **seven regressions only**, with no runtime, permission or schema change.

- Verify an empty proof and proofs signed for another participant or another run are rejected.
- Exercise the real coordinator join route with an omitted/empty proof and wrong-context proofs.
- Check the SQLite participant remains unclaimed, rejection evidence is recorded, and no successful identity/join event is emitted.
- After rejection, a correctly bound proof still joins and its session can read the participant directory.
- Sign explicit proof fields independently of the production proof helper to avoid a producer/verifier bug masking the test.

## Scope and source credit

This is a selected-scope follow-up to #156, not a merge of its legacy auth implementation. Its repaired caller checks at both verification and onward delegation remain useful references. Current Town has controller-issued flat Run Grants, not delegated capability chains.

Cascading revocation, verifier-side parent scope/expiry containment, replica/restart state and authenticated delegation callers remain future profile requirements. The legacy scenario test also documents that missing caller context blocks intermediary-to-leaf delegation; it is not a successful full-tree demonstration. Those wider requirements will remain explicitly recorded with the source disposition.

## Verification

- Baseline: **385 passed**, 8 existing warnings.
- Candidate full suite: **392 passed**, 8 existing warnings.
- New tests: **7 passed**; combined with existing key-binding tests: **11 passed**.
- Disposable in-process mutation removing proof verification: all **7 new tests fail**.
- Disposable mutation skipping verification only for empty proof: **3 fail / 4 pass**, covering the omitted/empty cases.
- Unmodified production rerun passes. No source mutation is written to disk.
- Self-review of the complete test-only diff; no blocking findings. No external service or legacy contributor code executed.

Run: `PYTHONPATH=src python -m pytest -q tests/test_grant_presentation.py tests/test_grant_key_binding.py`.