fix(rest): correct A_DENIED_SAVE fixture to a real sys_metadata_audit code

`check:error-code-casing` (ADR-0112 D1) flagged `code: 'metadata_locked'` in
the `A_DENIED_SAVE` audit-row fixture at meta-audit-capability-gap.test.ts:162
as a lowercase literal in a code position. It wasn't just a casing miss: the
value isn't a member of the closed `denied` vocabulary documented on
`sys_metadata_audit.code` (sys-metadata-audit.object.ts:134-139) — the system
cannot produce `metadata_locked`. Given the fixture's own
`lockState: 'locked'`, `lockOverridden: false`, the correct member is
`item_locked`.

The column is ADR-0112 D6b — a persisted audit column with its own
intentionally-lowercase vocabulary — so the fix is the per-line `adr0112-ok`
marker (with reason, matching the existing D6b markers in
metadata-protocol/src/protocol.ts), not a whole-file EXEMPT_FILES entry.

The renamed value has one other reference in this file (line 223), via the
same `A_DENIED_SAVE` object identity rather than a separately hardcoded
string, so no other assertion needed updating.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012WKSnqAaoqtW3QX7SSf1Vk

Author: claude

packages/rest/src/meta-audit-capability-gap.test.ts

@@ -159,7 +159,8 @@ const A_DENIED_SAVE = {
     source: 'studio',
     operation: 'save',
     outcome: 'denied',
-    code: 'metadata_locked',
+    // adr0112-ok: D6b — persisted audit column, its own lowercase vocabulary
+    code: 'item_locked',
     lockState: 'locked',
     lockOverridden: false,
     requestId: 'req_1',