docs(e2e): clarify test_list_events_denied_on_both_query_params scope

Per Greptile review on #277: the test's previous name + docstring claimed
to verify "BOTH query params are gated" by passing zero-UUIDs for both
task_id and agent_id, but FastAPI evaluates the ``task_id`` Depends first
and short-circuits before the agent_id gate runs. The test would still
pass if the agent_id gate were removed entirely — it doesn't isolate
either gate.

Rename and rewrite the docstring to be honest about what it actually
verifies: end-to-end route gating, no per-gate isolation. Independent
isolation would require granting one resource but not the other in
SpiceDB, which depends on a reachable spark-authz (out of scope today
per Gap 1 in #276 — pubsec-dev runs raw SpiceDB without spark-authz).

Author: dm36

scripts/spark-authz-e2e-tests/tests/test_event_authz.py

@@ -56,13 +56,17 @@ def test_list_events_without_agent_view_returns_404(
             f"{denied.text}"
         )
 
-    def test_list_events_without_task_view_returns_404(
+    def test_list_events_denied_on_both_query_params_returns_404(
         self,
         agentex_client_b,
     ):
-        """user_b lacks ``read`` on a task_id they have no relationship to →
-        ``DAuthorizedQuery`` on task_id collapses denial to 404. Symmetric
-        with the agent-side check; verifies BOTH query params are gated.
+        """When user_b is denied on both ``task_id`` and ``agent_id``, the
+        route collapses to 404. This verifies the route is gated end-to-end
+        but does NOT isolate which gate fired: FastAPI evaluates the
+        ``task_id`` ``Depends`` first, so the ``agent_id`` gate never
+        executes here. Isolating each gate independently would require
+        granting one resource but not the other in SpiceDB, which depends
+        on a reachable spark-authz (see ``authz_client`` skip behavior).
         """
         resp = agentex_client_b.list_events(
             task_id="00000000-0000-0000-0000-000000000002",