refactor(canopy-reference): build.rs generation of DenialReasonCode from cross-program-2026.json

DenialReasonCode (landed in MR !107 (merged)) hand-maintains variants that must stay synced with rulesets/federal/cross-program-2026.json trigger_reasons arrays. A build.rs that parses the federal ruleset at compile time and generates the enum variants automatically would eliminate the drift risk.

The Other(String) escape hatch already preserves ADR-011 source-of-truth at runtime — this is pure maintenance-burden reduction, not a correctness gap.

Extracted from tanf-denial-reason-code-from-jdm.adoc § Potential Improvements.