[&62 B2] Burndown: hoist program-scope authz gate into one extractor + retire fail-open default

Phase B / B2 (§B2). Hoist the inlined worker.in_program_scope(...) gate (~39x across 9 api/actions*.rs) into one extractor/middleware (DRY + removes the silent-forget footgun). Retire the fail-open empty-program-claim default (session.rs) -> deny-by-default. SECURITY dimension — pull forward into Phase A if treated as a security fix. Blocked by Phase A.