Add locked files and directory-only entries.

Locked files (--lock): repo-authoritative entries. Checkpoint skips
them (preserves repo version). Status reports "drifted" instead of
"modified". Restore always overwrites if hash differs, no prompt.
Use case: system-managed files the OS overwrites.

Directory-only entries (--dir): track directory itself without
recursing. Restore ensures directory exists with correct permissions.
Use case: directories that must exist but contents are managed
elsewhere.

Add refactored to use AddOptions struct (Encrypt, Lock, DirOnly)
instead of variadic bools.

Proto: ManifestEntry gains locked field. convert.go updated.
7 new tests. ARCHITECTURE.md and README.md updated.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

cmd/sgard/add.go

@@ -10,7 +10,11 @@ import (
 	"github.com/spf13/cobra"
 )
 
-var encryptFlag bool
+var (
+	encryptFlag bool
+	lockFlag    bool
+	dirOnlyFlag bool
+)
 
 var addCmd = &cobra.Command{
 	Use:   "add <path>...",
@@ -31,7 +35,13 @@ var addCmd = &cobra.Command{
 			}
 		}
 
-		if err := g.Add(args, encryptFlag); err != nil {
+		opts := garden.AddOptions{
+			Encrypt: encryptFlag,
+			Lock:    lockFlag,
+			DirOnly: dirOnlyFlag,
+		}
+
+		if err := g.Add(args, opts); err != nil {
 			return err
 		}
 
@@ -51,5 +61,7 @@ func promptPassphrase() (string, error) {
 
 func init() {
 	addCmd.Flags().BoolVar(&encryptFlag, "encrypt", false, "encrypt file contents before storing")
+	addCmd.Flags().BoolVar(&lockFlag, "lock", false, "mark as locked (repo-authoritative, restore always overwrites)")
+	addCmd.Flags().BoolVar(&dirOnlyFlag, "dir", false, "track directory itself without recursing into contents")
 	rootCmd.AddCommand(addCmd)
 }