fix: fail closed on divergent human same-source unify

[AllenXiao95]

First KISS Prevention slice for #46 after Recovery convergence in #51.

What changes

• At the production Review mutation boundary, same-source unify now checks the already-captured current TM before-image.
• If any target is already a local human + reviewed + formal row with a translation different from the proposed unified value, the entire unify request is rejected before any TM write.
• This applies to both per-group unify and the server-derived one-click plurality/majority bulk path because both converge on the same commit(..., action="unify") call.
• Normal per-coordinate human commit remains unchanged.

KISS boundaries

Deliberately not added in this slice:

• no override flag or force mode;
• no coordinate-exclusion workflow;
• no intentional_variant persistence yet;
• no new state machine / Review store / identity semantics;
• no frontend patch required: existing ReviewConflict/409 rendering already exposes the fail-closed reason.

The safe operator behavior for now is simple: when a divergent human finalization exists, bulk consolidation is no longer a convenience action; review that context explicitly.

Regression coverage

• per-group unify refuses a divergent human finalization and leaves all other group members untouched;
• one-click majority sync refuses before any partial write;
• rejected operations append no extra Review decision event;
• the refactor: converge Review recovery and dashboard delivery #51 after-image recovery regression is updated to create a safe unify rather than manufacturing a now-forbidden bad production write.

Refs #46