feat(mcp): physically enforce locks (chmod) + hosted content_hash wiring

Enforcement (opt-in via AXIS_ENFORCE_LOCKS) — the answer to "advisory locks can't
stop a non-participating agent":
- On grant, the server chmod's the locked file read-only (src/local/fs-guard.ts),
  so ANY process — including an agent that ignores Axis — gets EACCES on write.
- guarded_write briefly restores perms to write through the lock; release,
  complete_job, finalize_session, and force_unlock restore the original mode.
- Tracked per-instance (enforcedPerms) so it works across local/Supabase/API
  persistence — files are always local to the MCP server.
- Honest limit: a process running as the same user can chmod back; this stops
  cooperating tools + accidental clobbering, not a deliberate same-user attacker.

Hosted tamper-detection wiring (completes item from prior commit):
- Remote lock path now computes + sends contentHash; getLocks maps content_hash
  back through all three fetch paths.

8 new tests (fs-guard + enforced lock lifecycle incl. a rogue raw write rejected
by the OS). Full suite 82/82 green, tsc + eslint clean, dist rebuilt.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>