fix(authz): freeze catalog values after boot; correct compile-time-check claims

frozenMap only blocked the Map's own mutators, so
catalog.roles.get("editor").push("*") escalated a role to a full wildcard
past an error string claiming the catalog is frozen after boot; the same
applied to permission/attribute metadata objects and binding arrays.
mergeCatalogs now stores frozen copies of each, so the original declaring
module's objects are never mutated either.

Also corrects two docstrings (codegen.ts, the design doc) that claimed
`wrnexus authz generate`'s output makes a permission typo a type error —
can(), guardPermission(), and decideFor() all take a bare string and nothing
consumes the generated union automatically. Documents what it actually is:
a Permission/Role union to type your own helpers/constants against. Also
adds a README note on the subject.id contract (must be a non-empty string;
owner() compares with Object.is).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/plans/2026-08-04-authz-permissions-design.md

@@ -229,8 +229,10 @@ request.
 
 - `wrnexus authz list` — merged catalog across the workspace, with conflicts.
 - `wrnexus authz generate` — emits `app/authz/permissions.gen.ts` exporting
-  `type Permission = "post:read" | "post:write" | ...`, so `can()` is checked at compile time.
-  Runs automatically in `build.ts`, mirroring `regenerateQueries`.
+  `type Permission = "post:read" | "post:write" | ...`. `can()`, `guardPermission()`,
+  and `decideFor()` all take a bare `string` and nothing consumes this union
+  automatically — it exists to type your own helpers/constants against the
+  registered catalog. Runs automatically in `build.ts`, mirroring `regenerateQueries`.
 - `wrnexus authz init` — scaffolds the migration and a seed helper for default roles.
 - Admin UI: `.wrn` components for listing subjects and assigning roles, shipped in
   `@wrnexus/ui` behind the existing eject mechanism.