Block deleting protected VikingFS roots

[ZaynJarvis]

Summary

• add a delete-specific VikingFS access guard for rm()
• reject deletes of viking:// and viking://user aliases before AGFS/vector-store side effects
• keep public roots on the normal delete path, with session root verified as current-user scoped
• preserve existing non-root temp-root delete protection

Tests

• uv run --frozen --extra test python -m pytest -q tests/misc/test_vikingfs_uri_guard.py (27 passed)

Review notes

• Bob reviewed the first version and confirmed write/mkdir/mv are unaffected
• Follow-up tests cover his session-root and temp-root delete-path concerns