fix(ai): preserve tool authorization failures

[first-assist]

Summary

Preserve remote GraphQL tool authorization and principal-reauthorization failures at the AI runtime boundary. Authorization denials now reach the existing safe tool-failure classifier as non-retryable authorization_denied results instead of being mislabeled resolver_validation_failed.

Bumps graphql-orm-ai to 0.97.1; the persistent schema module remains 0.64.0 and no migration is required.

Verification

• Full graphql-orm-ai test suite
• Warnings-denied Clippy for graphql-orm-ai across all supported provider and host features
• Warnings-denied Rustdoc
• cargo-semver-checks against 585e1f0
• Documentation, release-state, workspace-inventory, dependency-boundary, release-manifest, package-release-policy, formatting, and diff checks

Documentation impact

Check exactly one option and explain the result.

• Documentation updated
• No documentation impact

Explanation: Updated the crate README, changelog, migration guide, implementation status, generated workspace inventory, package versions, and lockfiles.