fix(authz): strengthen permissionMatches warning, complete export coverage

Move the "don't gate on permissionsFor() with permissionMatches" warning
onto permissionMatches itself so it's visible via autocomplete, not just
on AuthzResolver.permissionsFor. Round out exports.test.ts to cover
scopeKey, safeRecord, and AUTHZ_LOCALS_KEY, closing the gap where
dropping either export from index.ts would not fail the test.

packages/authz/test/exports.test.ts

@@ -43,8 +43,14 @@ describe("@wrnexus/authz exports", () => {
       "decideFor",
       "guardPermission",
       "filterCan",
+      "scopeKey",
+      "safeRecord",
     ]) {
       expect(typeof (authz as Record<string, unknown>)[name]).toBe("function");
     }
   });
+
+  test("exports the locals key used to reach the per-request resolver", () => {
+    expect(typeof (authz as Record<string, unknown>).AUTHZ_LOCALS_KEY).toBe("string");
+  });
 });