fix(locks): a not-yet-created Dockerfile could not be locked

validateFileOnly stats existing paths, so an existing Makefile was fine — but
locking a well-known extensionless file an agent is ABOUT to create fell to
the no-extension heuristic and was rejected as a directory. The same
allowlist that fixes the hosted server (axis-frontend lib/axis-services.ts)
now rescues those names here, with BUILD/WORKSPACE/INSTALL matched
case-sensitively since their lowercase spellings are usually directories.