Fail closed on conflicting shared workspace renders - #97

Closes #95.

What changed

• preflight active local render claims by resolved workspace destination
• accept byte-equivalent idempotent claims
• reject incompatible claims before either owner writes
• mark every selected conflicting owner launch-ineligible
• check targeted materialization against the complete fleet
• expose render-owner-conflict through host-scoped validation
• document the ownership boundary in the VRS

copy and file compare their effective bytes, json-upsert compares the
expanded JSON value, and ensure-line compares the expanded ordered plan.
git-exclude remains additive/advisory.

Proof

Red before the implementation:

shared_workspace_conflicting_copy_targets_fail_before_any_write ... FAILED
assertion left == right failed: []
left: 0
right: 1

Green after:

• cargo test --lib: 161 passed
• cargo test --test run: 25 passed
• cargo test --test validate: 32 passed
• focused materialization:
  • conflicting owners fail before any write
  • a selected owner cannot bypass its sibling's claim
  • byte-identical shared claims remain idempotent