Remove static writePaths lock; detect concurrent lane overlap at spawn

[TheGreatAxios]

Closes CL-6952. Removes the static per-package writePaths authz lock (DirectorPackage.writePaths, AgentProfile.writePaths, and the gate.ts enforcement block at the old lines 394-413, plus write-path-policy.ts and its test) and replaces it with detection of concurrent lane overlap at spawn.

No shipped director ever set a non-empty writePaths (registry.test.ts explicitly asserted this) — this removes dead enforcement that only ever read as a live guarantee, not a working one.

What was deleted:

• DirectorPackage.writePaths / AgentProfile.writePaths and all propagation through registry.ts, task-tool.ts, RunSubAgentParams, SubAgentIdentity.
• The permission-gate enforcement block in gate.ts and the now-dead write-path-policy.ts (matchesWritePathAllowlist / writePathDeniedReason) plus its test file.

What replaced it:
A non-blocking conflict detector inside the existing task() dispatch in task-tool.ts. Each running dispatch is tracked (by call id) with the cwd it resolved to; a new dispatch checks currently-running lanes for one already working in the same cwd and records a concurrent-lane-overlap entry (new conflict class in intervention-log.ts) if so. A lane is removed from tracking the moment its dispatch finishes, so sequential work against the same cwd is never flagged.

Judgement calls:

• Intended scope: task() has no field for a caller to declare which paths a dispatch will touch, so nothing more precise than cwd is honestly knowable at spawn. Worktree-isolated lanes get a fresh, disjoint directory by construction and can never collide on this check; it only fires in the shared-cwd fallback, which is exactly the one mode where two lanes can really overwrite each other's writes.
• Block vs warn vs record: record only, never block. Two lanes sharing a cwd doesn't prove they touch the same files, only that they could — refusing the spawn on that alone would invent precision the signal doesn't have, which is worse than no check at all.
• Where to log it: intervention-log.ts, since it already tracks parent-side dispatch signal (refusals, outcomes) for this task tool instance. Added conflict as a new InterventionClass rather than overloading block/nudge, which mean something more specific (actually refusing/injecting).

Docs updated to match: docs/IMPLEMENTATION.md (5 spots — module table entries for task-tool.ts/identity-context.ts/gate.ts, the packageToProfile mapping note, and the primary-role/leaf-writePaths notes), docs/ARCHITECTURE.md (director-package field list, docs/design director tool-envelope note, primary-role note), and docs/PRODUCT.md (primary-role paragraph) — all previously described writePaths as an existing, enforced feature.

Gate: bun run check green — lint 0 errors, tsc clean, build succeeds, 5363 tests pass.

[linear-code]

CL-6952