fix(reports): merge report writes onto origin's latest reports data

[jimpablo]

Summary

Same member, two machines: session save --push, Stop-hook votes, member registration, and auto-report now sync the reports worktree under the reports lock before they read-merge-write. A stale local checkout can no longer drop the other machine's session, vote, or stats entry.

commitAndPushReports remains for tests and "files already sit in the worktree" writes. Production merge-writers go through updateReports. Read-only refresh (pushIfCreated: false) and HTTP reporting are unchanged.

Closes #561

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature causing existing behavior to change)
• Documentation only
• Refactor / internal cleanup

Test Plan

• npx tsc --noEmit passes
• npx vitest run passes (229 files, 3219 tests)
• npm run build && npm run test:e2e passes (138 passed, 26 skipped live-provider tests)
• Added/updated tests for the change
  • Real-git: stale checkout reads origin then writes n: 12 (not n: 11 / conflict)
  • Built CLI, two HOMEs, same alice: A runs members first, then B/A/B session save --push --force with alice-b0 / alice-a1 / alice-b1. Origin month log contains all three.
  • updateReports does not run the callback when the reports lock is busy
  • Stop hook skips updateReports when there are no pending vote deltas
  • Auto-report skips updateReports when nothing is pending; does not truncate snapshots when push returns false
• init unit tests still pass (lock-busy / ensure failure is not treated as "already registered")

Related Issues

Closes #561

Notes for Reviewers

• Do not cherry-pick 2469f0b (fix/reports-writer-sync). That branch predates fix(reports): keep teamai-reports reads fresh and read-only #560 (stash-create sync), fix(stats): finish report bookkeeping after pull timeout #562 (pushIfUnchanged / restore-on-failure), and fix(votes): persist upvote counts reliably across merge and hook dispatch #565 (vote merge).
• Nested lock is avoided by extracting lock-free commitAndPushReportsAt. Sync uses the existing fix(reports): keep teamai-reports reads fresh and read-only #560 stash create path, not --autostash.
• refresh then write is TOCTOU (lock released between them). Sync-after-write would rebase/reset under an uncommitted merge. Hence: lock → ensure → sync → write callback → commit → push → unlock.
• Auto-report still only truncates / advances snapshots when updateReports returns true (fix(stats): finish report bookkeeping after pull timeout #562).