[sophiecarreras]

The lock.legal_hold conformance check now accepts what real B2 answers when a file version under a legal hold is deleted: status 401 with code access_denied.

Real B2 was measured on 2026-11-10 and answers 401 access_denied. The check accepted only the shapes of the standalone simulator's older profile, so a simulator that matches real B2 made it fail.

• New .sdkharness/tests/lib/legal-hold-refusal.cjs, modelled on governance-refusal.cjs, with a unit test.
• Status 401 is accepted only with code access_denied. A successful delete, a bad token, 404, 5xx and network errors still fail; the older simulator shapes stay accepted.
• Unit test: red before (module missing), green after; accepting any error makes the "unrelated refusal" test fail.

Only test-harness files change; no library code.