Fix controller rotation authentication handling

[kentbull]

Follow-up to PR #351.

Treat SignedHeaderAuthenticator.inbound() as validate-or-raise in the agent rotation handler, translating authentication failures to the existing 403 response.

Tests: uv run pytest -q tests/ (76 passed).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.24%. Comparing base (4b7eb6c) to head (ba5001d).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #451      +/-   ##
==========================================
+ Coverage   88.02%   88.24%   +0.22%     
==========================================
  Files          26       26              
  Lines        5929     5931       +2     
==========================================
+ Hits         5219     5234      +15     
+ Misses        710      697      -13     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.