chore: public-boundary allowlist reseed — pin the v0.93.0 banked receipt JSONs (live_fingerprint = lane-commit system_fingerprint values, not prod binaries; 62 files), prune the 4 dspark-train docs the release scrub cleaned (previously allowlisted as terminated-instance ids), refresh policy-drift reasons