One lock mechanism for TS and bash, with a nonce and a heartbeat #124

Blocked by #113 and #114. Moving every caller onto one lock mechanism is safe only once nothing uses the old setup lock and every bring-up path takes the root lock.

Problem. The setup lock (a file, open wx) and the stone lock (a directory, mkdir) are two mechanisms, and the bash gemdb wrapper has its own copy of the stone-lock logic. None of them can tell a live holder from a reused pid, and none shows that a holder is still making progress. That leaves known gaps (below), and it blocks #116 item 3 and the issues that depend on a progress signal. Stop and a root-path change also take no lock at all.

Scope:

1. One mkdir-based lock primitive shared by TS and bash, with:
   • a nonce in the lock, so a reused pid is detected;
   • an mtime heartbeat, so "holder is alive and making progress" is something both sides can test.
2. Stop and root-path changes go through the lock, with a defined policy (wait or refuse). The start/stop policy itself is decided in the "Stop takes no lock" issue; the root-path policy is decided here.
3. Align EPERM handling in the wrapper with TS isAlive (CLI wrapper safety #116 item 3).
4. Retire the limitations accepted until now:
   • three stealers over a dead stealer's guard;
   • an orphaned put-back guard blocking steals for up to 5 s;
   • a claimer suspended for more than 5 s between creating the lock (setup lock: open wx; stone lock: mkdir) and the pid write (laptop sleep) can end up as a second holder;
   • 1.5.x (e.g. 1.5.4 in Cursor) steals without the guard, for as long as old versions are in use: it overwrites a dead-pid setup lock (it reads an empty one as pid 0, i.e. held), and rm+mkdirs an empty or dead-pid stone lock;
   • optional: sweep .steal.* tombs older than 5 s left by a crash (harmless debris).
5. CHANGELOG entry; update the "lock rules" paragraph in CLAUDE.md.

Not obvious: it must stay safe beside 1.6.0 and 1.5.x in another editor against the same root. A new on-disk format needs the argument for what an older version does with it before it ships. The 1.5.x stealing above is not fixable from here; it lasts as long as old versions are in use.

Enables: #116 item 3 (EPERM), and the follow-ups on Stop vs start and on the wrapper's lock wait.

Done when: the TS and bash sides pass a shared test of the lock format (claim, steal of a dead holder, reused pid, heartbeat). Two processes racing for the lock, one of them the wrapper, end with one holder.