V249 - CONSTANT ACCOUNT CHARACTER-FOLDER ACCESS LAW

Base: V248.

Permanent Law<gamefolderRouterSystem/> rule, re-applied continuously:

1. plain characters = ACCESS DENIED
2. characters_<!accountname> = ACCESS DENIED
3. characters_<accountname> = READABLE / IMPORTABLE / EXPORTABLE

Where <accountname> means the account currently logged into this BG2 instance.
The router accepts the account folder only when its full normalized folder name
and stored account flag both equal that logged-in account name.

Implementation:
- the router evaluates this law on every pulse (100 ms)
- the shared/plain characters directory is never accepted as character storage
- another account's characters_<name> directory is never exposed to the game
- only characters_<logged account> may be mounted into BG2's normal Import/Export path
- attempts to mount a non-active account fail closed
- the literal BG2 characters path, when needed by the engine, is only an internal
  junction to the allowed logged-account view; it is never a shared fallback

V248 account/slot laws remain:
- login -> account Existence=1
- while Existence=1 -> same-account login denied
- exit/window-X -> Existence=0
- empty slot -> character cleared, unaccountbound, unselectable
- filled slot -> accountbound
- join/leave Arbitration behavior remains one-shot from the V247/V248 base

No CHR/BIO backups or automatic restoration are added.
