feat(canopy-tanf): sanction denial path through eligibility ruleset

Source: tanf-denial-reason-code-from-jdm plan Potential Improvements.

The denial-reason-code hack had a sanction branch that is currently dead code — no JDM rule emits a sanction denial through the eligibility path. Sanctions today flow through work-requirements. If a future plan grows a sanction-denial rule in tanf-eligibility.json, the code-mapping path is one line of JDM config + one enum variant addition.

Acceptance: define when the eligibility path emits a sanction denial vs the work-requirements path; ruleset rule + matching DenialReasonCode variant; integration test.