Scope the PID lock to mutating commands (closes #150)

RunWithApp took the process-wide PID lock for every fx-backed command,
so read-only commands (info, snapshot list, snapshot verify, remote
info) failed with "already running" while a backup held it.

AppOptions now carries a lockMode, and each command declares its mode at
the call site. Only mutating commands (snapshot create, snapshot purge,
snapshot remove, prune, remote nuke) acquire the lock; read-only ones run
without it and are never blocked. snapshot restore is classified
read-only: it writes only to its target directory, not the local index
or remote store. The acquire/skip decision moves to a small
acquireLockIfMutating helper, covered by a test that a read-only command
runs while the lock is held and two mutators still exclude. The README
locking section is rewritten to match.

Model: opus-4-8

internal/cli/snapshot.go

@@ -92,6 +92,7 @@ specifying a path using --config or by setting VAULTIK_CONFIG to a path.`,
 					Cron:    opts.Cron,
 					Quiet:   rootFlags.Quiet,
 				},
+				Mode: mutating,
 			}, func(v *vaultik.Vaultik) error {
 				return v.CreateSnapshot(opts)
 			}, func(err error) {
@@ -125,7 +126,7 @@ func newSnapshotListCommand() *cobra.Command {
 		Long:    "Lists all snapshots with their ID, timestamp, and compressed size",
 		Args:    cobra.NoArgs,
 		RunE: func(cmd *cobra.Command, _ []string) error {
-			return runVaultikApp(cmd, false, false,
+			return runVaultikApp(cmd, readOnly, false, false,
 				"Failed to list snapshots",
 				func(v *vaultik.Vaultik) error {
 					return v.ListSnapshots(jsonOutput)
@@ -161,7 +162,7 @@ restrict the operation to specific snapshot names.`,
 				return errPurgeCriteriaBoth
 			}
 
-			return runVaultikApp(cmd, false, false,
+			return runVaultikApp(cmd, mutating, false, false,
 				"Failed to purge snapshots",
 				func(v *vaultik.Vaultik) error {
 					return v.PurgeSnapshotsWithOptions(opts)
@@ -212,6 +213,7 @@ func newSnapshotVerifyCommand() *cobra.Command {
 					Quiet:   rootFlags.Quiet,
 					JSON:    opts.JSON,
 				},
+				Mode: readOnly,
 			}, func(v *vaultik.Vaultik) error {
 				return v.VerifySnapshotWithOptions(snapshotID, opts)
 			}, func(err error) {
@@ -259,7 +261,7 @@ To wipe the entire destination store and start over, use 'vaultik remote
 nuke --force' — it is the single supported entry point for that.`,
 		Args: requireSnapshotIDArg,
 		RunE: func(cmd *cobra.Command, args []string) error {
-			return runVaultikApp(cmd, opts.JSON, opts.JSON,
+			return runVaultikApp(cmd, mutating, opts.JSON, opts.JSON,
 				"Failed to remove snapshot",
 				func(v *vaultik.Vaultik) error {
 					_, err := v.RemoveSnapshot(args[0], opts)