Allow AuthorizeActor while locked when expiry outlives unlock

[chunter-cb]

Summary

• While locked, AuthorizeActor is now permitted if the granted expiry outlives the unlock floor: now + delay when hard-locked, unlocksAt when a pending unlock is in flight. expiry == 0 (no expiry) always passes.
• A live actor may only have its expiry rewritten. Authenticator, scope, and policy (manager + commitment) stay frozen; changing them reverts AccountIsLocked. A new or already-expired actorId is a fresh add.
• Revoke, re-lock, and other authority changes stay frozen. A grant that would be dead by the soonest unlock is revoke-shaped and reverts ExpiryDoesNotOutliveUnlock.
• Lets high-rate payer accounts stay locked (mempool tier) while adding new keys or re-leasing existing 24h leases; rotation is add-new and let the old expiry elapse.

This is a spec change relative to the current EIP-8130 Account Lock section (authorize is listed as rejected while locked). Follow-up needed on the EIP text.

Test plan

• Hard-locked: expiry == now + delay reverts; == now + delay + 1 lands; expiry == 0 lands
• Pending unlock: expiry == unlocksAt reverts; == unlocksAt + 1 lands
• Re-lease / shorten of an existing actor is allowed if the new expiry is still above the floor
• Live-actor scope, authenticator, or policy rewrite while locked reverts AccountIsLocked
• Revoke while locked still reverts AccountIsLocked; epoch bump still succeeds
• Expired JIT authorize under lock is still a skip, not an ExpiryDoesNotOutliveUnlock revert
• Confirm EIP-8130 Account Lock wording is updated to match