feat(financial): RCS (553) import-only closed cohort

What

RCS/ERCS (UAS 553) closed to new enrollment 2014-01-01 (GA 22.8); existing recipients continue under renewal reviews (22.9). CRAIG must represent the cohort for payment continuity + 199 reporting WITHOUT allowing new enrollment: agreements enter only via a legacy import path (SHINES conversion), never via the create API.

Acceptance criteria

• Create API rejects program=rcs with a typed error naming the closed-cohort rule
• Import path (admin, audited) creates rcs agreements with legacy effective dates; renewal-review scheduling applies
• Axis-tagged tests (evil: attempted new enrollment)

Context

Epic child (e); depends on (a).