feat: Maintenance writes only in opted-in projects #373

Why

Maintenance can edit user-level files today (design: Maintenance).

In scope

Precondition in coordinator.mjs; user-scope providers become copy-only advice; Codex user file only through the register; recipes emit ak sync --upgrade.

Out of scope

New providers.

Acceptance criteria

• Every Maintenance write lands inside an opted-in root or goes through the register

Dependencies

Blocked by: #309, #345

Blocks: #378, #388

Plan

• Release: 4.0.0-beta.4
• Size: size:M · Workstream: ws:project-scope
• Epic: feat: project-scope P6, the dashboard for all work (epic) #301
• Card: P6-11 in the card inventory
• Sources: Design (docs(plans): project-scoped management design and its prerequisites #289) Maintenance

Verification

• node scripts/run-tests.mjs focus (new maintenance tests)