Datapacks should control gamerules without OP

Problem:
`command_blocks_work` exists but datapacks can't control it — datapack functions lack OP-level permissions, requiring manual intervention. Command blocks also default to enabled, creating a security gap in datapack-driven worlds.

Suggested Changes:
1. Default `command_blocks_work` to false — worlds that need them can opt in.
2. Allow gamerule overrides in `pack.mcmeta`, applied automatically on load:

{
"gamerule_overrides": { "commandBlocksEnabled": false }
}

3. Let datapacks lock a gamerule value so it can't be overridden without removing the datapack.

Why it matters:

 Pure mcfunction permission systems can be bypassed by a single command block.
 Datapacks should be self-contained — no OP commands needed after loading.
 Brings datapacks closer to plugin-level control without external tools.