fix: expose safe reconciliation rejection reason

[Pigbibi]

Scope

• Classify the existing HTTP 400 scheduler-identity rejection as missing or invalid, without logging any header value.
• Preserve the current rejection, authentication, broker, report, and execution boundaries. No new schema, dependency, workflow, or hash.

Evidence

• Three regression cases failed on the unchanged implementation because rejection was silent.
• Focused request/reconciliation/report/workflow tests: 69 passed. Ruff and diff check passed.
• Tested with the actual pinned QPK and strategy dependencies in an existing isolated Python 3.12 environment.

Limit

This fixes a diagnostic blind spot only. The production HTTP 400 root cause is not yet proven; no deployment, retry, or trading activation is included in this PR.