fix: lock the lockless load-modify-write paths

[REPPL]

Locks the lockless load-modify-write class (ledger issues iss-101 + iss-102, both minor bugs from the multi-agent hunt): the history index could drop a repo registration under two concurrent installs, and a >60s-stalled capture could have its just-committed issue file deleted by the orphan sweep after Capture returned success.

Chained PR: base is fix/iss-115-120-id-allocator-class (#137) — this branch touches the same capture files #137 changed and ledger-resolves with the --impact verb from #136. Merge order #136 → #137 → this; GitHub retargets automatically.

What changed

• One canonical inter-process lock primitive, fsutil.WithFileLock (O_NOFOLLOW + regular-file guard, polled non-blocking flock with timeout, fd released on every path). capture's withLedgerLock and the new ahoy withHistoryLock both route through it — no third flock. Pre-existing bespoke lock loops elsewhere are untouched (flagged, not expanded).
• iss-101: registerRepo's load-mutate-write of the history index runs inside the lock with a re-load; the interactive re-founding prompt stays strictly outside the lock (per the issue's hard constraint), and the prompt-validated state is re-checked in-lock — a changed candidate surfaces as a conflict, never a stale write. bootstrapHistory seeds atomically (write-then-link), so no O_EXCL zero-byte publish window.
• iss-102: the orphan sweep and the commit write both run under the ledger lock. Realized guarantee: success ⇒ file present — a commit losing the race fails loudly instead of being silently deleted. The pre-unlink re-check stays as defence in depth.
• Class sweep: every other load-modify-write site inventoried — already-locked (memory registry, spec/intent mints, history transcripts) or repo-local-only residue, recorded as iss-127 on this branch rather than fixed (out of the queued item's scope).

Verification

• Three failing reproductions watched first via deterministic interleaving seams (lost update; bootstrap check-then-act; sweep-deletes-committed-file), each failing pre-fix for the right reason and passing post-fix; plus a no-lock-across-prompt test whose prompter probes the flock mid-prompt, and a bootstrap publish-window test.
• Gate run independently by the orchestrator after all commits: make preflight exit 0, go test -race ./internal/... exit 0, record-lint exit 0.
• iss-101 and iss-102 resolved open/ → resolved/ on this branch with impact: fix.
• Independent reviews before this PR opened: security APPROVE with zero findings (attacked the flock fd-pinned TOCTOU and type guards, FIFO/device planting, the bootstrap temp/link race and permissions, in-lock parse bounds, and every silent-fallback path — nothing survived refutation); correctness PROMOTE with zero blockers. Review NOTES were dispositioned, not dropped: iss-128 (registerRepo's best-effort edges lose signal silently — contention skip and a marginal concurrent-double-install lineage-drop) and iss-129 (consolidate the four pre-existing bespoke flock loops onto the new primitive) are captured on this branch, and the stale "O_EXCL" comments were corrected to describe the write-then-link seed.