bug(exec): --dry-run requires writable quota-ledger lock

[Audacity88]

Summary

zoder exec --dry-run requires write access to the quota-ledger lock file. This prevents an otherwise read-only routing preview from running in restricted or sandboxed environments.

Reproduction

zoder exec --oneshot --dry-run --explain \
  --max-tokens 4000 \
  --model nvidia/nemotron-3-super-120b-a12b:free \
  --require-free \
  "review this public bundle"

When ~/.zoder is readable but not writable:

zoder: error: loading quota-routing ledger from ~/.zoder/ledger.jsonl: opening ledger lock at ~/.zoder/ledger.jsonl.lock: Operation not permitted (os error 1)

Current behavior

On current master, cmd_exec_oneshot calls RoutingContext::load before the cli.dry_run short-circuit. RoutingContext::load uses Ledger::entries_strict, whose lock path is opened with create/read/write access.

The dry run therefore needs a writable ledger directory even though it performs no model call and records no usage.

Expected behavior

--dry-run should be usable with read-only Zoder state. It should still read existing quota information when available, but it should not require creating or writing ledger.jsonl.lock merely to preview routing.

Possible approaches include a read-only ledger snapshot path for dry runs, or moving the dry-run resolution path ahead of reservation/write-lock setup while preserving quota-aware route accuracy.

Environment

• zoder 0.2.1
• macOS arm64
• Reproduced from a sandbox that permits reading but not writing ~/.zoder