fix(ci): approve codewhale-sanitize in the portable config proof

Since 16e2e422e9 every pull request fails "Test (ubuntu-latest)" at
"Check portable config policy boundary" with
"[config-proof] FAIL: unapproved normal dependency: codewhale-sanitize".
All eight open Dependabot PRs (#6999-#7006) hit it, including the
workflow-only bumps. 16e2e422e9 made tests/portable-config depend on
codewhale-sanitize, because the mounted config group calls
codewhale_sanitize::sanitize::is_bidi_control. Its message records the
crate as service-free, but ALLOWED_WORKSPACE in
scripts/check-command-config-proof.py was not updated. The step runs
only for pull_request and workflow_dispatch, so main's push CI stayed
green and never showed the failure. It reproduced locally on main
f09a30a6b5.

codewhale-sanitize joins the approved workspace crates. Its normal
dependencies (icu_properties, regex, serde_json, url) include nothing
from FORBIDDEN_SERVICES. HOST_IMPORT still rejects the host crates.

Verification:
- python3 -B scripts/test_check_command_config_proof.py: 7 tests OK.
- sh scripts/check-portable-config.sh (the CI step, run under the
  build lock): "[config-proof] PASS: actual complete group and approved
  normal dependency graph". The no-default-features check passed, and
  nextest -p codewhale-portable-config ran 35 tests: 35 passed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01NBKbhx19BRbZtvWK8rVKjz

scripts/check-command-config-proof.py

@@ -33,6 +33,7 @@ ALLOWED_WORKSPACE = {
     "codewhale-portable-config",
     "codewhale-command-contract",
     "codewhale-protocol",
+    "codewhale-sanitize",
 }
 FORBIDDEN_SERVICES = {
     "tokio", "reqwest", "hyper", "rusqlite", "sqlx", "keyring", "dbus", "zbus",