Add locked files and directory-only entries.

Locked files (--lock): repo-authoritative entries. Checkpoint skips
them (preserves repo version). Status reports "drifted" instead of
"modified". Restore always overwrites if hash differs, no prompt.
Use case: system-managed files the OS overwrites.

Directory-only entries (--dir): track directory itself without
recursing. Restore ensures directory exists with correct permissions.
Use case: directories that must exist but contents are managed
elsewhere.

Add refactored to use AddOptions struct (Encrypt, Lock, DirOnly)
instead of variadic bools.

Proto: ManifestEntry gains locked field. convert.go updated.
7 new tests. ARCHITECTURE.md and README.md updated.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ARCHITECTURE.md

@@ -687,6 +687,27 @@ on disk is newer or the times match, sgard prompts for confirmation.
 **Timestamp comparison truncates to seconds** for cross-platform filesystem
 compatibility.
 
+**Locked files (`--lock`).** A locked entry is repo-authoritative — the
+on-disk copy is treated as potentially corrupted by the system, not as
+a user edit. Semantics:
+- **`add --lock`** — tracks the file normally, marks it as locked
+- **`checkpoint`** — skips locked files entirely (preserves the repo version)
+- **`status`** — reports locked files with changed hashes as `drifted`
+  (distinct from `modified`, which implies a user edit)
+- **`restore`** — always restores locked files if the hash differs,
+  regardless of timestamp, without prompting. Skips if hash matches.
+- **`add`** (without `--lock`) — can be used to explicitly update a locked
+  file in the repo when the on-disk version is intentionally new
+
+Use case: system-managed files like `~/.config/user-dirs.dirs` that get
+overwritten by the OS but should be kept at a known-good state.
+
+**Directory-only entries (`--dir`).** `add --dir <path>` tracks the
+directory itself as a structural entry without recursing into its
+contents. On restore, sgard ensures the directory exists with the
+correct permissions. Use case: directories that must exist for other
+software to function, but whose contents are managed elsewhere.
+
 **Remote config resolution:** `--remote` flag > `SGARD_REMOTE` env >
 `<repo>/remote` file.