Canonical Sigra auth denial subcodes and shell-safe detail sanitization.

Phase 54 keeps :step_up_required as the public shell reason. These subcodes give operators stable, low-cardinality auth facts without exposing secret or identity-bearing values.