Seed runner registration audit grant

[cbusillo]

Summary

• Seed the deploy-time GitHub Actions authz grant for runner-lane-registration.yml to write runner lane registration audit evidence.
• Add regression coverage so the deploy grant script keeps runner_lane_registration_audit.write wired.

Context

PR #1237 made the runner-lane registration workflow use service-backed audit writes. The service route requires runner_lane_registration_audit.write; without this grant, the workflow would 403 in real use.

Validation

• uv run python -m unittest tests.test_product_onboarding.ProductOnboardingTests.test_deploy_authz_grants_include_runner_registration_audit_writer
• shellcheck scripts/deploy/ensure-authz-grants.sh
• shfmt -d scripts/deploy/ensure-authz-grants.sh
• uv run python -m unittest tests.test_product_onboarding tests.test_authz_grant_service tests.test_every_code_reconciliation
• uv run --extra dev ruff format --check tests/test_product_onboarding.py
• uv run --extra dev ruff check tests/test_product_onboarding.py
• uv run --extra dev mypy tests/test_product_onboarding.py
• git diff --check