Clarify lock trust boundaries and filesystem guarantees #641

Problem

The documentation does not give users one contract for native locks, strict soft locks, expiring leases, hostile peers,
and network filesystems. The SoftReadWriteLock paragraph lists same-UID non-cooperating processes before a permissions
clause, then excludes hostile same-UID co-tenants in the next sentence:
docs/how-to.rst.
Modes 0o600 and 0o700 restrict other UIDs; they do not protect a pathname from a process running under the same UID.

Native file locks are advisory on the supported platforms. Java tells callers to use one channel per file and warns that
network filesystems can impose limits:
java.nio.channels.FileLock.
CMake requires a declared guard scope and states that a directory lock does not cover its children:
file(LOCK). SQLite assigns locking to its VFS, and
WAL does not support readers and writers on different hosts: lockingv3 and
WAL disadvantages.

Required documentation

Define ownership scope for each public lock: acquisition object, thread, task, process, or descriptor. State which
operations survive fork(), descriptor duplication, task cancellation, and process exit. Explain that native locks
coordinate cooperating processes and do not deny direct access to the protected resource.

Document strict soft locks and expiring leases as separate contracts after
#636. Describe owner-specific claims from
#637, lease compromise reporting, fencing requirements, stale-break
authority, and malformed-marker handling. State the same-UID threat boundary without relying on file modes.

Publish a filesystem support matrix based on measured behavior. Distinguish local Linux, macOS, and Windows filesystems
from NFS and SMB. Do not promise a network filesystem unless the verification work in
#642 covers it.

Acceptance criteria

The terminology must match public APIs and behavioral tests. Examples must identify the protected resource, the trust
boundary, and the consequence of an expired holder. Include migration guidance for users who relied on timed stale
breaking as mutual exclusion.