receipt gate: bound the age of a consumed receipt #773

Follow-up to #723 (receipt gate enforce: mctlhq/mctl-gitops#1980).

The gate accepts a consumed, not-yet-executed approval of any age. mctl-agents' policy checkpoint consumes the receipt immediately before the call, so a legitimate receipt is seconds old when the gate sees it; an old consumed-but-unexecuted receipt is either a crashed run or a replay.

Proposal: refuse a receipt whose consumed_at is older than a short bound (minutes, configurable), with its own refusal code, audited like the others. Check the bound against the approval's existing fresh_until as well.