[sophiecarreras]

The lock.legal_hold conformance check now accepts what real B2 answers when a file version under a legal hold is deleted: 401 with code access_denied.

Real B2 was measured on 2026-11-10 and answers 401 access_denied. Until now the check accepted only the codes the standalone simulator used to return, so a simulator that matches real B2 made the check fail.

• Unauthorized is accepted only when its code is access_denied. A bad or expired token (InvalidAuthToken), any other Unauthorized code, a successful delete, 404, 5xx and network errors still fail.
• The previously accepted shapes stay accepted, so the check passes against both the old and the new simulator.
• test/unit/test_sdkharness_lock_refusal.py covers the new leaf: red before the change, 30 passed after; accepting any Unauthorized makes 5 of them fail.

Only test-harness files change; no library code.