fix(people): reapply bounded header authority after confirmed-hire authentication #334

Canonical owner: PR #55 confirmed-hire transport boundary.

#333 bounded the pre-authentication Authorization header collection, but HireAcceptanceAsgiApp re-reads scope["headers"] after awaiting the authenticator for Idempotency-Key and Content-Type. Test-first 909a1f139a34140c5c30cd3cdd292133f11c8aeb proves an exact post-auth replacement can exceed 16 KiB before body consumption. Repair ceef8e74adf9d7416af6eafce54be897c0161ef4 adds _bounded_hire_headers(...), revalidating exact containers/scalars plus the canonical 64-header, per-pair 16 KiB and aggregate 16 KiB budgets before post-auth semantic scans.

#335/#336/#337 subsequently advance the same canonical owner without weakening this transport repair. Current #55 exact head is 947ecf15b5a0e1d88758a2fdc118ce0157034e0b; descendants are #149 73464ddfe9b3563a717919ff8dabf7b36b5d9c44, #155 e164a2d046972ea0d6bfb138734c19bfae3084ff, #156 5f508c28b253db2b89bd854435da38c437182a49.

Current exact-head runs: Foundation 34858404911, Security 34858404825, SAST 34858404605, CodeQL 34858404718, all queued at the latest sweep. No predecessor GREEN/review transfer and no hosted GREEN is claimed. Keep open until protected exact-head acceptance/integration.