Tolerate workstation clock skew in the sitting-requester token check

A 3 s WSL2 clock lag made a freshly issued KeyCape token fail PyJWT's iat
check (ImmatureSignatureError), surfacing only as contained_operation_failed.
Allow 30 s leeway and record the exception class, never its message.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 272244@bnt-lap001
Assistant-Session: c8962fa7-b290-47df-865f-403ddb6c77e9

tools/create_sitting_approvals.py

@@ -156,7 +156,7 @@ def main() -> int:
     try:
         _create(rows, origin.rstrip("/"), receipt)
     except Exception as error:
-        receipt["failure"] = str(error) if isinstance(error, Refused) else "contained_operation_failed"
+        receipt["failure"] = str(error) if isinstance(error, Refused) else "contained_operation_failed:" + type(error).__name__
         print(receipt["failure"], file=sys.stderr)
         return 2
     finally:
@@ -236,6 +236,7 @@ def _create(rows, origin, receipt):
         algorithms=["RS256"],
         issuer=ISSUER,
         audience="approval-engine",
+        leeway=30,
         options={"strict_aud": True, "require": ["sub", "iat", "exp", "iss", "aud"]},
     )
     roles = claims.get("roles")