fix(harness): retire stale legacy evidence allowlist entries

Parent: #384 (P1-4a).

## Scope
Enforce a monotonic legacy-evidence allowlist and remove entries that already have fingerprints; resolve the remaining F01/F14/F18 debt with auditable evidence or explicit decision.

## Acceptance
- Fingerprinted items remaining in the allowlist fail validation.
- The allowlist cannot grow without an explicit reviewed exception.
- Current stale entries are removed and tests cover reverse consistency.

Delivery discipline: one issue, one worker branch, one PR.

Start by locating the TypeScript harness code that validates the legacy-evidence allowlist and any existing reverse-consistency tests. Trace the F01, F14, and F18 entries and their fingerprints. Done means fingerprinted entries fail validation, unreviewed allowlist growth is rejected, stale entries are removed, and reverse-consistency tests pass.

Written by the indexing model from the issue text.