Artifact asset reads/publishes now refuse to write onto a bound working copy

The Artifact tool's read_asset and publish paths now check whether the target location is a bound or managed working copy, such as a synced git checkout, and refuse to save a fetched asset or publish onto it instead of silently overwriting it. The refusal surfaces as asset_read_onto_working_copy.