harness: three gate fixes found by running against real code

The allowlist parser stripped only whole-line comments, so an entry carrying the
reason it exists — the format allowed-deps.txt documents — failed the gate and
would have blocked every dependency ever added.

The interface{}/any advisory printed a line number instead of a filename when
only one file matched, because grep -n omits the name for a single file, and it
matched the word "any" in prose comments.

"Nesting past 4" fired at four tabs, which a closure inside a function reaches
unaided.

HARNESS.md

@@ -82,7 +82,7 @@ load-bearing mechanism here, and the one with least machine enforcement, which i
 fails any `.go` change that does not touch `state.md`. That does not prove the counters are *right*;
 it makes forgetting them impossible, which is the real failure mode.
 
-**The dependency allowlist** names modules that are permitted, not required. Being listed is permission;
+**The dependency allowlist** names modules that are permitted, not required. `#` starts a comment anywhere on a line, including after an entry — the gate strips those, so an entry may carry the reason it exists. Being listed is permission;
 `DEPS_MAX` counts what `go.mod` actually pulls in. `scripts/allowed-deps.txt` is the list.
 
 **Budgets in `scripts/budgets.env`.** Two hard LOC ceilings, core and extensions, plus a dependency