fix(locks): a local grant now says it only binds this machine

propose_file_access returned a bare "Access granted for <path>" from the
local fallback, and an agent handed that tells its user the file is safe
to edit. On a team that is false: a teammate's agent, on their clone, is
blocked by nothing. The lock is real, its scope is not what the word
implies, and the only signal was a logger.warn on stderr, which MCP
clients never surface to anyone.

This is the funnel's quiet failure too. There are twice as many projects
as signups, so more people run Axis locally than have ever connected a
board, and nothing in the experience tells them what they are missing or
that the guarantee they think they have is narrower than they think.

The two local cases are distinguished because they call for different
responses. Never configuring a board is a choice. Having one configured
and unreachable is a failure, and reaching the fallback with
coordination.enabled or useSupabase set means exactly that.

Tests verified to fail against the pre-fix code, not merely to pass
against the new: reverting lock-registry.ts turns two of the three red.
The third stays green on purpose, guarding that advertising limited
scope did not weaken the exclusion that does hold. 166 pass, typecheck
clean.