CDN-221: The Claim Firewall

CDN-221 places a hard language boundary on top of the CDN-220 intake harness. Each validator verdict maps to exactly one allowed public claim label. The current fixture set produces seven candidate labels, 27 forbidden-promotion rows, zero observed TTY allowances, and zero entropy or biosignature allowances. Fitted c/f evidence remains fitted-null diagnostic only; GO-6456 remains an external forecast check with no c/f opener; clean future c/f rows remain admissible templates only until populated by observed evidence.