feat(mcp): enforced guarded_write + honor resolve() label + hosted lock fingerprints

- guarded_write tool: the server performs the write only if the caller holds the
  lock AND the file is unchanged since lock time (NO_LOCK/DENIED/CONFLICT),
  refreshing the fingerprint on success. This is real prevention — verify_file_lock
  is only detection. (Addresses "enforced, not just evident, locks.")
- createSessionIdentity.resolve() now honors a specific incoming label via
  resolveAgentId (a client-supplied id is kept, still pinned to the session token;
  AXIS_AGENT_ID still overrides). Aligns the impl with the documented contract.
- Hosted tamper-detection: locks store content_hash in Supabase mode too
  (migration 0009, getLocks mapping, best-effort store on grant). The external
  hosted-API path still needs its own server-side column write.

Full suite 76/76 green; tsc + eslint clean; dist rebuilt.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>