fix(cli): owner-only engine state and a clean refusal for an untrusted lock dir

[jasonssdev]

Summary

• Lock directory (<tmp>/openkos-locks-<uid>) is trusted only if it is a real directory, owned by the current euid, with no group/other bits; the lock file is opened with O_NOFOLLOW and mode 0600. Any OSError from creating/opening maps to a new typed WorkspaceLockUnavailableError, which _guard_workspace_lock turns into a clean refusal (exit 1, naming the path and the fix) instead of a traceback. Exit 3 stays reserved for genuine contention, because this refusal is not fixed by retrying.
• New engine state is created owner-only: .openkos/ and bundle/.state/ (plus dirs beneath it) 0700; every SQLite store 0600 before first write (WAL/-shm inherit it, verified by test). Existing files/dirs are left as found; bundle/, raw/ and concepts are untouched.
• doctor reports exposed engine state with a one-line chmod go-rwx fix. It emits a line only when something is exposed, so the fixed check count is unchanged.

Related issue

Closes #1134
Closes #1135

Type of change

• Security hardening / bug fix

How was this tested

Strict TDD: RED observed first for both issues, then GREEN. Mutation-checked uid, mode, symlink, O_NOFOLLOW, touch_private mode and the doctor mask. ruff check, ruff format --check, mypy . clean; full pytest tests 7713 passed, 2 skipped. Mode/ownership tests are POSIX-only (skipif Windows); owner mismatch is simulated by patching os.geteuid.

Checklist

• Tests added, specs updated (derived-index-cache, doctor-command), CHANGELOG ### Security, docs/cli.md exit-code note

Notes for reviewers

• doctor test fixtures that hand-build .openkos/ now run under a 0o077 umask so they stay quiet.
• Cross-user behaviour was simulated, not run on a shared host.