mt: seal the C1 loader invariant by type (Unscoped<T>), not a deny-list
mt: seal resource-in-community behind CommunityScope (ultra-fuzz CHRONIC C1)