fix(acp): publish actionable enrollment errors

[RossHartmann]

Summary

• recognize only the Kiingo bridge's exact identity/subscription enrollment guidance shape, closed machine-code allowlist, and standard ACP application-error code
• publish that trusted guidance once as a signed Buzz failure notice
• dead-letter the request immediately instead of retrying an eligibility failure
• preserve existing retries for transport failures and ordinary provider/application errors

Production evidence

A bounded synthetic member with a verified Buzz identity and zero Codex pools reached the deployed bridge and returned buzz_codex_subscription_not_connected. The deployed Buzz agent retried that terminal error and never showed the member the already-actionable enrollment link. The fixture created no receipt, task, lease, provider diagnostic, or cross-user credential selection, and all relay/Kubernetes/database fixtures were independently removed before this change.

Focused validation

• cargo test -p buzz-acp actionable_agent_error --lib (3 passed)
• cargo test -p buzz-acp auth_error --lib (5 passed)
• cargo clippy -p buzz-acp --lib -- -D warnings
• cargo fmt -p buzz-acp

The broad protected matrix remains authoritative in CI.