feat(diff): disallow editing done tasks by default

Problem: Done tasks could be freely edited in the buffer, leading to
accidental modifications of completed work.

Solution: Add a `lock_done` config option (default `true`) and a guard
in `diff.apply()` that rejects field changes to done tasks unless the
user toggles the checkbox back to pending first.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

lua/pending/config.lua

@@ -100,6 +100,7 @@
 ---@field view pending.ViewConfig
 ---@field max_priority? integer
 ---@field sync? pending.SyncConfig
+---@field lock_done? boolean
 ---@field forge? pending.ForgeConfig
 ---@field icons pending.Icons
 
@@ -114,6 +115,7 @@ local defaults = {
   date_syntax = 'due',
   recur_syntax = 'rec',
   someday_date = '9999-12-30',
+  lock_done = true,
   max_priority = 3,
   view = {
     default = 'category',