fix: refuse change inspection while locked

[johnson-ricon]

Summary

• classify readability from the exact managed manifest's Git filter and Git Crypt header before interpreting note state
• fail clearly for locked change, stage, commit, diff, list, search, audit, show, parse, new, obfuscation, suppression, and conflict consumers
• keep notes pull available while locked while skipping readability-dependent checks and reconciliation
• preserve normal plaintext and unlocked behavior without requiring repo-global rudi state
• cover task entry points and shared direct consumers so wrappers cannot bypass the guard

Addresses #194 and the locked mutation boundary described in #22.

Signed source history

• Johnson's initial focused fix: 0ce0909f4087ed88478f30eb470a3227d8d2f1aa
• Junior's shared-boundary fix-up: 53fd27a1fd6f20cbc86f5cb6ad996dcf8d29cc96
• Fix-up integration head: dfecde3af0105cc3dee5e2a963d0caa2eb999c4a

Validation

• mise run test readable-state (6 passed)
• mise run test changes stage commit diff pull (96 passed)
• mise run test (459 BATS passed; 3 environment skips; 9 Python passed)
• real preserved locked-clone smoke: clear nonzero diagnostic, no opaque path disclosure
• no-mutation checks for locked stage/commit/new/obfuscate/deobfuscate/suppression consumers
• locked pull smoke through a real Git remote
• all 8 configured Codebase lints
• mise run doctor (README and lints green; optional local pre-commit hook absent)
• readme build --check
• Bash syntax, Python compile, and git diff --check
• fix-up PR fix: guard readable note state centrally #196 hosted macOS and Ubuntu checks passed