Hotfix witness resling authorization drift and stale active-polecat accounting after PMKB canonical refill #402

Live repro on 2026-04-02 after PR #401 was truly deployed. PMKB canonical refill wake used issues #1300/#1301/#1302 and initially attached all three lanes; witness classified them active-output. Within minutes all three stalled. Witness then attempted resling each lane but skipped them as unauthorized (RESLING_SKIP_UNAUTHORIZED) even though direct GitHub REST still shows labels [sgt-authorized, plan] on issues #1300/#1301/#1302. At the same time SGT state became internally inconsistent: PMKB rig rollup still reported active_polecats=3 while the sgt status polecat list was empty and no corresponding sgt-pmkb-* tmux sessions were present. Acceptance: (1) witness resling must honor live/cached authorization truth for still-labeled issues, or emit the concrete label-read/cache failure instead of false unauthorized skips; (2) failed/stalled reslings must not leave rig rollups claiming active polecats when none are actually tracked/running; (3) after canonical refill attaches #1300/#1301/#1302, either the lanes remain truly tracked/running or the rig surfaces one truthful blocker instead of split-brain state.