Problem #1220

Problem

rhodium-standard-repositories/actions-allowlist/ is the only part of the
rhodium tree that did not move into 9-archive/ (#1218). It stayed because it
is a live published interface: allowed-actions.json is fetched by raw URL
from

• .github/workflows/allowlist-preflight-reusable.yml
• .github/workflows/governance-reusable.yml

and from consumers outside this repo. Relocating it is a breaking change, so
the move left it behind and standards-map.toml now carries a residual entry
recording that.

That is a stable state, not a finished one. The current path is a leftover from
a tree that has otherwise been archived, and it should not be permanent.

What is needed

A deprecation and redirect plan:

1. Publish allowed-actions.json at a new stable path outside the archived
   tree.
2. Serve both paths for a deprecation window, with the old one marked
   deprecated.
3. Instrument who is still fetching the old URL.
4. Retire the old path once the window closes.
5. Update the residual standards-map.toml entry and remove it.

Acceptance

• New path published and documented.
• Old path still served during the window.
• Residual map entry updated or removed at the end.