harness: three gate fixes found by running against real code

The allowlist parser stripped only whole-line comments, so an entry carrying the
reason it exists — the format allowed-deps.txt documents — failed the gate and
would have blocked every dependency ever added.

The interface{}/any advisory printed a line number instead of a filename when
only one file matched, because grep -n omits the name for a single file, and it
matched the word "any" in prose comments.

"Nesting past 4" fired at four tabs, which a closure inside a function reaches
unaided.

HARNESS.md

@@ -82,7 +82,7 @@ load-bearing mechanism here, and the one with least machine enforcement, which i
 fails any `.go` change that does not touch `state.md`. That does not prove the counters are *right*;
 it makes forgetting them impossible, which is the real failure mode.
 
-**The dependency allowlist** names modules that are permitted, not required. Being listed is permission;
+**The dependency allowlist** names modules that are permitted, not required. `#` starts a comment anywhere on a line, including after an entry — the gate strips those, so an entry may carry the reason it exists. Being listed is permission;
 `DEPS_MAX` counts what `go.mod` actually pulls in. `scripts/allowed-deps.txt` is the list.
 
 **Budgets in `scripts/budgets.env`.** Two hard LOC ceilings, core and extensions, plus a dependency

scripts/verify.sh

@@ -219,7 +219,8 @@ direct=$(echo "$reqs" | awk '$2=="direct" {print $1}' | grep -v '^$' || true)
 total=$(echo "$reqs" | grep -cv '^$' || true)
 
 if [ -f scripts/allowed-deps.txt ]; then
-  allowed=$(grep -v '^[[:space:]]*#' scripts/allowed-deps.txt | grep -v '^[[:space:]]*$' || true)
+  # the file documents "# starts a comment", so strip trailing ones too, not just whole-line
+  allowed=$(sed 's/#.*//' scripts/allowed-deps.txt | sed 's/[[:space:]]*$//' | grep -v '^$' || true)
   unlisted=""
   for d in $direct; do
     echo "$allowed" | grep -qxF "$d" || unlisted="$unlisted $d"
@@ -364,9 +365,11 @@ if [ -n "$panics" ]; then bad "panic() outside cmd/ — request-time failure deg
 head_ "smells (advisory)"
 nowrap=$(echo "$gofiles" | xargs grep -n 'fmt\.Errorf(' 2>/dev/null | grep -v '%w' | wc -l | tr -d ' ')
 [ "${nowrap:-0}" -gt 0 ] && note "$nowrap fmt.Errorf without %w (wrap at package boundaries)"
-anyuse=$(echo "$gofiles" | grep -v '_test\.go$' | xargs grep -ln 'interface{}\|\bany\b' 2>/dev/null || true)
+# -H forces the filename even for a single file; comment lines are prose, where "any" is a word
+anyuse=$(echo "$gofiles" | grep -v '_test\.go$' | xargs grep -Hn 'interface{}\|\bany\b' 2>/dev/null |
+  grep -vE ':[[:space:]]*//' | grep -v 'map\[string\]any' | cut -d: -f1 | sort -u || true)
 [ -n "$anyuse" ] && note "interface{} or any present (no empty interface for flexibility): $(echo "$anyuse" | tr '\n' ' ')"
-deep=$(echo "$gofiles" | xargs awk '/^\t\t\t\t[^\t}]/ {print FILENAME; nextfile}' 2>/dev/null | sort -u || true)
+deep=$(echo "$gofiles" | xargs awk '/^\t\t\t\t\t[^\t}]/ {print FILENAME; nextfile}' 2>/dev/null | sort -u || true)
 [ -n "$deep" ] && note "nesting past 4 (conventions.md): $(echo "$deep" | tr '\n' ' ')"
 deadexp=$(echo "$gofiles" | grep '^\./internal/' | grep -v '_test\.go$' | xargs grep -hoE '^func [A-Z][A-Za-z0-9_]*' 2>/dev/null | awk '{print $2}' | sort -u |
   while read -r sym; do