Use _refused in the remaining refusal tests and drop a dead hash-length branch

[Deicyde]

Follow-up to #152 and #153, from the post-merge notes on each (#152 comment 6010274834, #153 comment 6010275110).

• Tests (-14 lines). test_rejects_unknown_release_before_writing, test_invalid_planned_roadmap_is_never_published and test_group_writable_parent_is_refused_with_a_remedy repeated _refused's checks by hand. They now call it. Each keeps its error code and message assertions, and _refused's unchanged-parent check covers the absent target and the empty stage glob they asserted.
• _git_blob_id (-2 lines). Its only caller passes the length of an object ID that _committed_scaffold_entries has already matched against 40 or 64 hex digits (scaffold.py:339), so the unknown-length branch could not run. The hashlib.new ValueError fallback stays; test_plugin_pin_is_empty_when_git_digests_are_unavailable pins it.

Left out: the other #153 note, routing the mode string at scaffold.py:399 through _canonical_template_mode. It saves no lines, and the inline expression reads more clearly.

This still merges cleanly with #151 at its repaired head e0f31f26, although both edit the same test file.

Validation at exact head 553d79c2: Ruff is clean; the three changed tests pass; tests/test_scaffold.py -k pin passes (22); all 9 GitHub checks pass, including both real-Lean and Windows jobs. The exact-head agent audit found no blocker; human GitHub review is pending.

[Deicyde]

Exact-head review at 553d79c2: the remaining refusal-test helper conversions preserve error codes, remedy text, arguments, and stricter full-parent snapshots; the removed hash-length branch is unreachable because the sole validated caller supplies only uniform 40/64-hex IDs. Both Python 3.10/3.13, both Windows, both real-Lean runs, CLA, lint, and focused tests pass. No blocker remains.