fix: complete the unpaired-machine sweep + regression test

Follow-up to the call-site guards: a full sweep of every machine_npub deref
found one more reachable crash — _record_rejected (tasks.py) logs
machine_npub[:12], and the assert_nostr_attribution guard now routes an
unpaired machine there, so None[:12] -> TypeError. Fall back to machine.id.

Every other deref is safe by the attribution-gate invariant: a settlement only
flows past assert_nostr_attribution (now rejecting unpaired) for a paired
machine, so the downstream distribution / parse-path / "landed" logs can't see
None; the collision-loop display already uses `(m.machine_npub or m.id)`.

- tests/test_unpaired_machine_guards.py: regression — assert_nostr_attribution
  rejects an unpaired machine (domain error, not AttributeError) and
  build_state_d_tags skips it.
- tests/test_pair_endpoint.py: update the fake_pair mock for bunker_relay/
  keystore_passphrase (pre-existing drift from #29; was failing before this PR).

Full suite green (213 passed).

tests/test_pair_endpoint.py

@@ -66,7 +66,15 @@ def _wire(monkeypatch, *, pair="ok"):
     async def fake_owned(machine_id, user_id):
         return _machine()
 
-    async def fake_pair(machine, *, relays, admin_client, duration_hours=None):
+    async def fake_pair(
+        machine,
+        *,
+        relays,
+        admin_client,
+        bunker_relay=None,
+        keystore_passphrase=None,
+        duration_hours=None,
+    ):
         if pair == "error":
             raise PairingError("boom")
         return _result()