fix: reject stale concurrent add writes

[smiggleworth]

Summary

• add expected-content preconditions to shared file changes
• serialize validation and staged replacement under sorted per-file transaction locks
• guard page routes, action registries/authorizations, database manifests, and environment examples
• reject stale plans before any generated artifact can be staged or written
• recover abandoned lock directories while retaining a bounded live-lock timeout

Linked issue

Closes #91

TDD

• Red c640210: generic stale-write, concurrent page, concurrent action, and database-conflict regressions fail against the old implementation; both concurrent commands incorrectly return 0.
• Green 1e7529c: expected-content transactions and add-command snapshots make the focused regressions pass.
• Audit guardrail 8730341: captures the action registries before descriptor discovery and deterministically protects that narrower interleaving.

Guardrails

• generic stale shared-file transaction test, including no orphan and lock cleanup
• deterministic concurrent add page and add action barriers
• action registry mutation during descriptor discovery
• database manifest mutation between plan and write
• exact expected-content protection for optional .env.example

Acceptance audit

• Every acceptance criterion in Concurrent 'askr add' invocations race on shared registry files, silently dropping a registration while reporting success #91 is checked with evidence.
• Full local npm run check: 253 tests pass with coverage gates, plus lint, types, changelog, build, docs, publint, and package checks.
• Packed templates and minimum Askr peer integration pass.
• Deterministic performance gate passes.
• Dependency audit reports zero vulnerabilities.
• Exact-head hosted CI passes on Ubuntu, macOS, and Windows, including audit, packed templates, peer floor, and performance.
• Release @askrjs/cli@0.0.25 from the exact squash merge.
• Clean registry-only consumer proof.

Local verification

• npm run check
• npm run test:templates
• npm run test:peer-floor
• npm run bench
• npm audit

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[smiggleworth]

Release closure:

• PR fix: reject stale concurrent add writes #93 squash-merged as 2397346ac099c0f173a80155e55366660184b5c4.
• Publish run 31902660447 passed the full reused CI, publish verification, tag/publish, and public database-command smoke jobs: https://github.com/askrjs/askr-cli/actions/runs/31902660447
• Annotated tag v0.0.25 resolves to the exact squash commit.
• npm serves @askrjs/cli@0.0.25 with integrity sha512-UvVi4pL0svap3NxxhDyV/vYraf/vUj5kLotZixzhke2f4Q1ZRevlbutaOXqjOimJq7v8Hxmc20C+ZywM9/oonw==.
• A clean registry-only consumer created a SPA with the published CLI, launched two real CLI processes adding pages concurrently, observed exits [0, 1], verified the successful route and page, verified the failed registration and page were both absent, and matched the clear File changed before writing diagnostic.
• The clean consumer reported CLI version 0.0.25 and zero runtime audit vulnerabilities.