Address QA review feedback on the signoff e2e suite (86b24a5e):
- Use dedicated port 3199 with local_trusted mode to avoid reusing
the dev server in authenticated mode (fixes 403 errors)
- Add proper agent authentication via API keys + heartbeat run IDs
- Fix non-participant test to actually verify access control rejection
- Add afterAll cleanup (dispose contexts, revoke keys, delete agents)
- Reviewers/approvers PATCH without checkout to preserve in_review state
Co-Authored-By: Paperclip <noreply@paperclip.ing>