handleRefusedRequest

Answer a refused request with 400 carrying the check's own message, so the bound that was broken reaches the caller.

Scoped to GovernanceRequestException on purpose. Handling IllegalArgumentException here would turn a store's own argument failure into a 400 and tell an operator to fix their request when the fault was server-side.