feat(helpers4-common): add h4_ensure_volume_writable

[baxyz]

Summary

• Four features (pnpm-store, playwright-dev, claude-dev, mistral-dev) each carry their own copy of "named volume starts root-owned, chown it for the current user" — not actually one pattern. pnpm-store/playwright-dev's volumes are exclusive per container (keyed by ${devcontainerId}), so an unconditional chown is safe. claude-dev/mistral-dev's are deliberately shared across every concurrently-running project for the same host user (keyed by ${localEnv:USER}), where blindly chowning would steal the volume out from under another project's still-running session — they instead claim it only while still root-owned, and chmod o+rwX to share it once someone else already has.
• Adds h4_ensure_volume_writable <path> [--shared] covering both cases in one implementation.
• Verified locally against all 5 branches (non-shared: no-op when already owned, chown otherwise; shared: chown when root-owned, no-op when already mine, chmod when owned by someone else; sudo-unavailable warning path) with a mocked stat/id/sudo harness.
• Updates AGENTS.md's design-constraints note (which still described the old copy-this-pattern approach) to point at the new helper.

Sequencing: landing this on its own first, ahead of migrating the four consumers to call it — devcontainer features test resolves a consumer's dependsOn on helpers4-common from the published GHCR registry, not this repo's local src/ tree, so a consumer PR bundled with this one would fail its own CI against a not-yet-published function (AGENTS.md already documents this exact sequencing issue). The four-consumer migration PR needs release.yml run manually after this merges, to actually publish helpers4-common 1.2.0 to GHCR before that PR's CI can resolve the new function.

Board card: "Factor named-volume ownership handling into helpers4-common" (Backlog, Medium priority).

Test plan

• bash -n syntax check, JSON validated
• Mocked unit tests for all 5 branches of h4_ensure_volume_writable
• CI

🤖 Generated with Claude Code

[github-actions]

✅ PR Validation Passed

All checks passed!

---

📋 Pipeline Status

	Job	Status
✅	🧾 Conventional Commits	passing
✅	🔖 Version Bump	passing
✅	🧪 Feature Tests	passing
✅	🐚 ShellCheck	passing

---

_{🤖 Generated by @helpers4 CI • 2026-09-08}