Add writes.py: the single gate every write tool must pass. A write happens only when confirm=true AND writes are enabled (off by default); otherwise a dry-run preview is returned. Every executed write is appended to an audit log. New `familiar writes [enable|disable|status]` CLI and a read-only write_status MCP tool. 81 tests, coverage 92%. Closes #22. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>