fix(885): the never-asked message reports what the RUN did, not what the registry sent

"WITHOUT issuing a Bearer challenge" is a claim about the registry's response that
this script never checks. `probe` enters the token leg on a `401` only, so a `403`
carrying a perfectly good `Www-Authenticate` would be refused with that sentence
having never looked at the header — the same defect one branch over, in the message
written to fix it.

It now says NO TOKEN WAS EVER REQUESTED, which is a fact about the run: the token
leg was not entered, and this answer was never followed as a challenge. The
assertion and the outcome-table row move with it, and the comment says why the
weaker claim is the honest one.

Refs #885

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015QqCpYFsKgnAnx6jVwrKiV

scripts/tests/test_ci_toolchain_image_resolves.py

@@ -318,7 +318,7 @@ def test_a_refusal_with_NO_CHALLENGE_never_claims_a_token_was_obtained(preflight
     assert preflight.authenticated_manifest_calls() == [], "no read can have carried a token here"
     if refusal == "403":
         assert preflight.token_calls() == [], "a 403 first read must not even ask for a token"
-        assert "WITHOUT issuing a Bearer challenge" in result.stderr, result.stderr
+        assert "NO TOKEN WAS EVER REQUESTED" in result.stderr, result.stderr
         assert "PUBLIC" in result.stderr, "the message must still name a cause an operator can act on"
     else:
         # A challenge-less 401 DOES enter the token leg (and abandons it for want of a realm), so it