test(sdkharness): lock.bypass_governance and lock.per_file_retention accept B2's 401 access_denied

[sophiecarreras]

What

The repository-owned conformance checks lock.bypass_governance and lock.per_file_retention delete a governance-locked version without bypassGovernance and require a refusal. They accepted only AccessDenied, RetentionWriteError, Conflict or BadRequest. B2 refuses that delete with 401 (b2sdk: Unauthorized), as this repository's raw-API contract test shows (test/integration/test_raw_api.py: with pytest.raises(Unauthorized): raw_api.delete_file_version(...) on a governance-locked version, then the bypassing delete succeeds). The standalone B2 simulator (v0.4.1, default profile) now answers the same, so both checks failed against it with refused with Unauthorized.

Change

• refused() takes access_denied_401=True for the delete-without-bypass call: it additionally accepts Unauthorized only when its code is access_denied. InvalidAuthToken (bad or expired token), any other Unauthorized code, 5xx, 404 and network errors still fail. Delete allowed still fails ("the call was permitted").
• Header note in both checks explains the 401 and that the exact code and message are not verified against real B2 (UNVERIFIED in the simulator's ledger).
• test/unit/test_sdkharness_lock_refusal.py: 20 tests; 18 fail on the previous leaves and pass now (accepted: 401 access_denied and the old classes; still failing: allowed operation, bad token, other 401 codes, unverified email, 5xx, not found).
• Changelog fragment +sdkharness-lock-refusal.infrastructure.md.

Verified

Through the dispatchers (.sdkharness/tests/run-conformance), Python 3.12:

• embedded harness simulator (answers 400): both checks PASS;
• standalone b2-simulator v0.4.1 (answers 401 access_denied): both checks PASS;
• a simulator patched to allow the delete without bypass: both checks FAIL ("the call was permitted; the claim under test is that it is refused").
  ruff check and ruff format --check are clean on the touched files.

Not run: the full nox matrix and the integration suites. CI on this PR will show the known live-encryption failures (#614) unrelated to the change.

Opened for review; not merged.

🤖 Generated with Claude Code