[AHMv2] [Registrar] Para lock mechanism post AHMv2

[Ank4n]

Context

A para's registration has a lock. When set, the manager loses deregister, schedule_code_upgrade etc -- it stops whoever registered a chain from tearing it down or rewriting it once real users depend on it. The para itself and root can still call those.

Pre-migration

• Locked at the para's first head (OnNewHead). One-shot: once remove_lock has run, it never re-locks.
• add_lock: manager | para | root.
• remove_lock: para | root only: a lock protects the para from its manager, so the manager may not lift it.

Post-migration

• Locked the first time the para holds a lease or workload.
• Same behaviour as RC. If removed lock (by para or root), does not lock itself again unless explicitly set by manager | para | root.