The black-veiled, barefoot bomb-hoax suspect who lurched down Boylston Street for more than a minute on the anniversary of the marathon bombings “should not have been allowed to walk two blocks,” Mayor Martin J. Walsh conceded yesterday as officials scrambled to assure the expected crowd of 1 million that Monday’s race will be safe.