Implement staleness validation and skip-with-banner

Every crossing validates its expectations before writing: each step
carries per-item HistoryExpectations — folder, effective ancestor-walked
liveness, and exactly the fields the gesture set — and a mismatch pops
the step, posts the signpost ('Undo skipped — Fix login changed outside
Lanework'), and falls through to the next. Validation reads disk, not
the in-memory snapshot: the snapshot is by construction one reload
behind every app write, so a rapid second undo would false-skip against
the pre-state — disk is what current can honestly mean at press time.
Stale and failed part ways: a stale step is one the board moved past,
so dropping it loses nothing; a failed one is refused by a usually
momentary condition, so it stays put and the crossing stops with only
performWrite's own error row — which forced the provider off
NSUndoManager onto two plain arrays, since a popped group cannot be put
back. The read-only lock disables Undo/Redo through the adapter while
the stack survives to resume on clear. Delete and restore validate
presence alone — a machine timestamp is not a decision — and a
malformed field matches nothing, since it is a shape the app never
writes.

Claude-Session: https://claude.ai/code/session_01SR4XGjmBE16ZUYWpfFHXwY

Kanban/App/AppModel.swift

@@ -557,7 +557,14 @@ public final class AppModel {
             store: store,
             recordID: recordID,
             history: history,
-            undoManager: BoardUndoManager(history: history),
+            // The lock's enablement half (13-native-undo.md ▸ Rules): Undo and Redo disable with the
+            // other mutating commands while the board refuses writes, and the stack survives to
+            // resume when it clears. Weak, so the adapter is never the reason a closed board's store
+            // stays alive; a store that has gone answers "writable", which is moot — its stack went
+            // with it.
+            undoManager: BoardUndoManager(history: history, isReadOnly: { [weak store] in
+                store?.isReadOnly ?? false
+            }),
             cardRefs: [],
             access: access
         )