Add strict ACL startup mode for reference servers

Problem

Reference servers can start without explicit ACL configuration, which risks unintended permissive behavior.

Why now

The repo positions these servers as security-conscious references; fail-closed startup on missing ACL config should be enforceable.

Current behavior is insufficient

There is no strict startup mode that consistently blocks launch when required access-control inputs are missing/invalid.

Expected behavior

Add strict mode that fails startup for missing ACL configuration on filesystem/fetch/git servers.

Acceptance / Validation

• Strict mode flag/env blocks startup when ACL config is absent or invalid.
• Deterministic error classification for missing ACL inputs.
• Tests cover strict-mode failure and non-strict behavior.

Evidence packet

• Commit under test: 72efc42 (origin/main)
• Runtime environment: macOS arm64, Node v22.19.0
• Minimal repro:
  1. Start filesystem/fetch/git server with strict mode enabled and no ACL config.
  2. Observe startup behavior.
• Expected: immediate fail-closed startup error.
• Actual: startup can proceed without explicit ACL guard.

Likely codepaths

src/filesystem, src/fetch, src/git.

Start by reading the server code under src/filesystem, src/fetch, and src/git, then reproduce startup with strict mode enabled and no ACL configuration. Trace how missing or invalid ACL inputs are handled and inspect the existing test setup. Done means strict mode fails startup deterministically while non-strict mode retains its current behavior, with tests covering both paths.