feat(approvals): atomic claim to fix concurrent-exec race (v0.3.1)

[amittell]

Summary

Two concurrent agentcli exec calls on the same gated task could both observe the same pending approval and both consume it, allowing both to execute from one grant. This PR adds claimApproval: an atomic find-then-consume primitive wrapped in an fs-lockfile. enforceApprovalGate in src/exec.js now uses claimApproval in place of the separate findValidApproval + consumeApproval pair. Concurrent claims serialize to exactly one winner per grant.

Cuts v0.3.1 (pure bug fix, no CLI or manifest schema changes).

Design

• openSync(lockPath, 'wx') for atomic lock creation (works on macOS/Linux/Windows)
• Atomics.wait on a SharedArrayBuffer for sync backoff during contention — no new npm deps, no busy-waiting, no child processes
• Stale locks (older than 30s) are treated as abandoned (crashed holder) and broken
• approval_lock_timeout (default 5s contention window) surfaces genuine deadlocks
• Signature verification still runs after the atomic claim; a bad signature refuses execution and the consumed grant is audited

Test plan

• npm run lint clean
• npm test green — 663/663 (was 659 + 4 new concurrency tests)
• Worker-thread test (N=8 parallel claims on one grant) — exactly 1 winner, 7 null returns, 0 errors
• Two pending grants + two parallel claims — both succeed with distinct grants
• Stale lock (hour-old mtime) is broken, claim proceeds
• Fresh lock held past timeout raises approval_lock_timeout with correct error code
• CI lint-test passes

Files

• src/approvals.js — withApprovalsLock helper, claimApproval exported, updated module-level comment
• src/exec.js — enforceApprovalGate rewired to claimApproval, import list adjusted
• src/index.js — barrel export of claimApproval
• src/describe.js — approve command summary mentions serialization
• test/approvals.test.js — 4 new concurrency tests
• package.json — 0.3.0 → 0.3.1
• CHANGELOG.md — new 0.3.1 section