ci: resolve expired lane-whitelist exceptions

[EffortlessSteven]

CI Policy is currently red because three CI lane whitelist entries expired on 2026-08-07:

• affected_proof_plan
• proptest_smoke
• publish_surface

Observed on PR #2937 in workflow run 34176494260, job 101906831952; the strict linter reports exactly those three expired lanes. This is pre-existing CI-governance debt and is not caused by the Dependabot cooldown diff.

Acceptance

• Re-evaluate each expired lane against current CI economics and proof ownership; do not simply extend dates by default.
• For each lane, either promote it into the durable whitelist with current evidence, remove/retire it, or create a bounded replacement exception with owner, reason, and a new review horizon.
• Run cargo xtask ci-lane-whitelist --workflows .github/workflows --whitelist policy/ci-lane-whitelist.toml --exceptions policy/ci-whitelist-exceptions.toml --report-dir target/tokmd/reports --strict and require zero findings.
• Confirm the CI Policy workflow returns green on main/a representative PR.
• Preserve the existing rule that expired exceptions fail closed rather than being silently ignored.

Keep this separate from #2937; that PR should not renew unrelated expired CI exceptions merely to turn its checks green.

[EffortlessSteven]

Rechecked current canonical state before implementing anything: this issue is stale branch-state, not live CI debt.

Both EffortlessMetrics/tokmd/main and EffortlessMetrics/tokmd-swarm/main currently have policy/ci-whitelist-exceptions.toml with no active exceptions. The file explicitly states that expensive lanes now run on push, explicit labels, or risk-pack routing instead of ordinary PR defaults. The three expired entries observed on #2937 therefore came from that rollout branch's older lineage, not current canonical policy.

No renewal/removal PR is needed. Closing this issue avoids reintroducing already-retired exceptions.