Tighten Container init: propagate use_lock, register container_provider under base, reject non-IntEnum scope

[lesnik512]

Summary

Three small `Container` fixes surfaced by the 2026-06-05 bug-hunt audit (nice-to-have items #1, #2, #3 in `planning/audits/2026-06-05-bug-hunt-audit-report.md`).

• `build_child_container` now propagates `use_lock`. `Container(use_lock=False)` previously got locking back the moment the user descended into a child container, silently undoing the opt-out documented at `docs/providers/factories.md:99-105`. Fixed by forwarding `use_lock=self.lock is not None` to the child constructor.
• `container_provider` now registers under `Container` (base), not `type(self)`. Subclassing `Container` previously broke the documented auto-injection pattern (`docs/providers/container.md:14-27`): a creator annotated with the literal `Container` class could not be resolved on a subclassed root container, even though the `Self` return types on `build_child_container` / `find_container` indicate subclassing is supported.
• `Container.init` now rejects non-IntEnum `scope` values up front via a new `InvalidScopeTypeError(ContainerError)`. The signature was already typed `enum.IntEnum` but unenforced; passing `Container(scope=99)` previously succeeded and exploded later from `repr` (or any other site that touched `scope.name`) with a bare `AttributeError`.

Three new regression tests in `tests/test_container.py` cover all three behaviors.

Test plan

• 3 new tests pass; full suite green (139 passed).
• 100% coverage maintained.
• `just lint-ci` green.

🤖 Generated with Claude Code