fix: prototype Linux descriptor-level flock attribution

[abruption]

Problem and proposed behavior

A held lock plus one visible opener does not prove that the opener participates in that lock. This draft adds Linux descriptor-level granted FLOCK evidence tied to the original inode, same-user process start ticks and sampled execution state. The independent OS probe remains separate. Final attribution runs synchronously under native coordination, which is released before SIGTERM.

Collection has FD-count, byte and elapsed-work budgets. Unsupported storage/namespace mappings and denied, malformed, changed or ambiguous evidence refuse recovery. Positive participation does not establish sole lifetime control, complete visibility or atomic PID signaling. JSON v1 adds optional owner.startTicks, owner.commandFingerprint and lock.probe.participation; the command fingerprint hashes the executable-path string and cmdline bytes, not executable-image contents.

Prerequisite #135 has merged. This branch is rebased onto the v0.4.6 main commit 3bc40919446c47d274b2d369d08ea1cdf373b74b. It remains Draft in v0.4.7; no merge or publication is proposed while the research gates below remain open.

Validation and evidence limits

• At f9a031f0317a23ef9384da1c2de2c464e5923b67, CI run 38397383963 passed all 33 checks. Linux x64 Node24 reported 245 total, 244 passed and one filesystem-case-sensitivity skip. Actual synthetic FLOCK participation, inherited descriptions, nonlocking candidates, fdinfo denial and signal-boundary cases were exercised. These results do not measure a deployed native Codex process.
• Local validation at that earlier source: npm ci/check/lint/test/package smoke passed, with 242 passes and three Linux-only skips on macOS.
• Parallel independent source reviews used claude-opus-5-5 (response model confirmed) and isolated Codex CLI0.162.1 default (actual model unconfirmed). First input SHA256: 38751846ef1c8755e929285d37ee5580de489a440bacd9d4a2ed692a82ffd4f4; revised source input: c8c8ed1372e7c8f3ab67b667d3bd6b2ab9078471d3f19c3f44ec59d2fd92ae75. Reviewers did not certify later commits or run Linux tests.
• Documentation-only commit 854bc35c7d4b9d68882f29fefb178c1cf617c162 passed local diff and package checks but CodeQL could not analyze C# or Rust because that older branch contained neither language's source files. The rebase includes the actual source from main without altering CodeQL settings.
• Current rebased commit b483cd587c62329243366e64aaaac477edd36adc: npm ci/check/lint/test/package smoke and git diff --check passed. Local suite: 278 total, 272 passed, six Linux-only skips, no failures. Range comparison preserves all seven draft-specific commits; the two fix: preserve lossless lock and transcript identities #135 identity commits were already present on main. All 39 PR checks passed, including repository CI run 38501519527 and CodeQL run 38501514971. CodeQL passed all five language analyses, including C# and Rust. No automatic review comments were visible when these results were checked; earlier source reviews do not certify this commit.
• The current source correction distinguishes the process-hardening library's behavior from verified helper callers. Targeted inspection of pinned Codex 092d3acd6bec3e3a14bdc7e7a2810ab628ab759d found calls in the responses API proxy, voice host and sandbox host bridge; the ordinary CLI entry point does not directly call those functions. This is not an exhaustive call-graph proof or evidence that a deployed writer is necessarily dumpable.

Remaining draft gates

1. Measure or explicitly bound native-process access assumptions. Same-user access may fail for a non-dumpable candidate or restrictive procfs policy. No elevation or process-hardening changes are proposed. Draft docs: record guard liveness and macOS refusal-filter evidence #139 now records one synthetic non-dumpable access-matrix run on Linux 7.0 Oracle/aarch64: FD/fdinfo/executable reads were denied while cmdline and start ticks remained readable. It did not execute this adapter, establish its classification, or measure deployed native Codex dumpability, so this gate remains open.
2. Resolve guard liveness before readiness. Every synchronous syscall lacks a hard deadline; the 25ms budget is checked between calls. Cmdline reads can wait for target memory while coordination remains held. Moving them after guard release can leave the earlier inode/participation/PID evidence stale; having no await alone does not establish safety.
3. Complete relevant denied/budget/namespace/replacement cases and document actual supported-storage evidence. PID signaling races, same-path re-exec, incomplete family discovery and hidden references remain limitations.

Refs #126 and #100. No force mode, owner SIGKILL, native-file removal, privilege elevation or Windows support is added. Keep #126 open until its acceptance criteria and the remaining gates are satisfied.