Review: tighten the in-place byte write guard

Reviewing the guard against itself surfaced two defects. The allowlist was keyed
by file, so a new in-place write inside an already reviewed file passed silently,
and internal/wsrelay/manager.go was listed without ever matching a pattern.

Record the reviewed occurrence count per file and reject any deviation in either
direction: an added write in a reviewed file now fails, and a stale entry whose
writes disappeared fails too. Drop the entry that never matched.