Run Tier 3 trace-forward against a live stub Pancake, nothing patched

[sumerjohal]

What

Every Tier 3 trace-forward test patched _resolve_holders and _append_to_meal_chain, so the two HTTP calls that make Tier 3 what it is, the ledger write to Pancake and the holder lookup from Pancake, had never been exercised in this repository (review ledger AG-016: "the identity tier has never been run end to end").

Change

app/tests/test_tier3_live_pancake.py. A stub Pancake listens on a real socket (http.server, ephemeral port), implements POST /audit/events and POST /fieldlists/holders, checks the headers Pancake checks, and records every request. AR2 is pointed at it through PANCAKE_URL. No function in app/ is replaced.

Five tests:

test	shows
..._runs_end_to_end_against_a_live_ledger_and_holder_service	the ledger packet leaves the process over HTTP with the shared secret, the subject, the seed, the scope, the matched lots and the credential jti; the holder request carries the authority credential and names the lots; the answer is wired into matches; the ledger write comes first
..._holder_the_service_does_not_know_is_reported_unresolved	partial answers are reported, not invented
..._unreachable_ledger_refuses_the_disclosure_before_asking_for_holders	503, and the stub sees no traffic
..._holder_service_that_refuses_is_a_502_after_the_ledger_entry	the entry is on the record before the refusal
test_tier1_touches_pancake_for_nothing	the control: without an authority credential the stub sees nothing, so the traffic above is Tier 3's

app/tests/testkit/grants.py is added byte-identical to the copy in #19, so the two merge cleanly in either order.

harness/bin/stomata run: 12/12. Suite 177 passed, 1 xfailed (was 172). Lint 36, unchanged.

No production code changes. Review finding A3, 2026-10-08.