Fix Genesis 001 production provenance runtime allowlist

[ael-dev3]

Summary

• permit the already-reviewed auth-bridge parser dependency tree in exact production checkout attestation
• preserve rejection of unrelated ignored dependency namespaces
• add a protected-main regression fixture covering both cases

Production safety

The blocked Genesis 001 attempt failed at the first detached-HEAD provenance check, before the publisher opened its ephemeral credential file, created an authenticated transport, performed a live read, built recovery metadata, or released a publish. Private recovery and final-receipt inventories remain empty.

Verification

• focused regression red before fix, green after fix
• provenance/transport suite: 54/54
• notification live-receipt suite from clean commit: 19/19
• adjacent independent-review suites: 67/67
• typecheck
• production build and asset audits
• sealed-launch preparation gate
• independent security review: no blockers