feat(amicode): context tree marks proprietary vault context locked

[kateebonner]

Stacked on #83 (merge that first).

What

Two honesty fixes to the context tree's interactivity, from Kate's live testing:

1. The cursor now tells the truth. Only nodes a click actually opens (project files, browsable vault files) wear the pointer. Turn numerals, skills, agents, and bash actions — which have nothing to open — show the pan cursor (previously turns showed a pointer that clicked into nothing). The click-acknowledgement ring also only fires on openable nodes.

2. Proprietary context is locked, visibly and upfront. Files that live in a vault mount that refuses browsing (e.g. armonissima, kind team, fail-closed per Vault browsing: fail-closed by kind + public-only hackathon mode #69) render dimmed with a padlock glyph, wear a not-allowed cursor, and clicking them is a no-op. Keyboard navigation announces "locked — this vault does not allow browsing". Previously the click dead-ended in a Vault-panel refusal after the fact.

How

• Server — GET /amicode/vaults stamps each mount with browsable, computed by the vault-browser's existing fail-closed law (browseAllowed deployment gate + mountBrowseRefusal kind/marker rules). Additive to the relayed wire shape; unparseable CLI bodies pass through untouched.
• Panel — fetches the mount list once, derives a vaultLocked(mount) predicate: browsable:false → locked; mount missing from the list → locked (can't be browsed anyway); list unavailable or legacy server without the field → status quo (no lock claim we can't back).
• Data — buildContextTree takes the predicate; vault leaves carry locked.
• Engine — locked nodes: 0.3-alpha fill, fg-ink padlock drawn beside the label (shape signal, not color-only), not-allowed on hover, no select/ring on click.

Verification

• Unit: vaults annotation suite (fail-closed law, ghost mounts, gate-off, junk passthrough) 20/20; context-tree data + engine 21/21.
• Live (Playwright, real mount stack): /amicode/vaults stamps armonia-issimo/armonia-template browsable, armonissima not; synthetic-tree engine run verifies cursor law (pointer / not-allowed / grab), click no-op on locked, padlock + dim rendering in both themes.
• Real-session regression: a session touching only the personal vault keeps all nodes openable (correctly un-locked).
• Typecheck all packages + oxlint 0 errors.

🤖 Generated with Claude Code