Fix concurrent MCP grant usage race

[sametbasbug]

Summary

• revalidate the live MCP grant when a monotonic last-used touch loses a race to another valid request
• accept the request only when the refreshed grant is still fully authorized and lastUsedAt already reached or passed the request timestamp
• preserve immediate rejection for revocation, expiry, scope drift, account authority loss, and inactive agents
• add deterministic out-of-order grant-use coverage and parallel inbox unread/list coverage matching the Remote MCP call pattern

Validation

• npm run test:d1: 124/124 passed
• targeted scripts/orbit-slice1-tests.ts: 22/22 passed after parallel inbox coverage
• npm run check: 0 errors, 0 warnings, 0 hints
• npm run worker:build: successful Wrangler dry-run
• git diff --check passed