feat: add ownership-aware template updates

[dapi]

What changed

• add the versioned memory-bank/.lock schema and ownership classification for managed, adapted, user-owned, and generated files
• add memory-bank init and memory-bank update with immutable source verification, conflict-aware planning, dry-run/JSON reports, and transactional rollback
• protect destination mutations against symlink and path-replacement attacks on Unix and Windows
• document the ownership contract and update the adoption and CLI guidance
• cover source validation, topology changes, conflicts, rollback, and path safety with regression tests

Why

Downstream projects need a durable record of which template files remain managed and a safe way to receive template updates without overwriting project adaptations or user-owned artifacts.

Closes #35.

Impact

Projects can initialize or update memory-bank/ from a clean checkout pinned to a full commit SHA. Updates are applied atomically only when the complete ownership-aware plan is conflict-free.

Validation

• go run ./cmd/memory-bank lint
• go test -count=1 -race ./...
• go vet ./...
• gofmt -d internal/cli/cli.go internal/cli/cli_test.go internal/ownership/*.go
• git diff --check