fix: recover watcher and serialize database writers

[stsoul]

Summary

• keep the file watcher retrying when another CodeGraph writer holds the project lock
• cap exponential lock backoff without permanently degrading auto-sync
• serialize mutating CLI and MCP database sessions with a process-lifetime writer lease
• reject malformed or live-PID lease takeovers while recovering from dead owners

Root causes

The watcher previously treated lock contention like a terminal sync failure. After five retries it degraded permanently, discarded pending state, and could not recover when the competing writer exited.

Separately, the short-lived index lock protected individual synchronization calls but not the complete lifetime of a mutating process. An MCP server and an index/sync command could therefore open and mutate the same SQLite database concurrently. The new project-local writer lease covers the mutating process lifetime and uses PID liveness for stale-owner recovery.

Behavior

• lock retry rate remains bounded at the existing maximum interval, while retry lifetime is unbounded
• a successful watcher sync resets the backoff counter immediately
• read-only CLI operations do not acquire the writer lease
• mutating CLI operations and MCP sessions acquire the same lease
• malformed lease records fail closed; leases owned by dead processes can be reclaimed

Validation

• npm run build: PASS
• focused Vitest run: watcher, MCP catch-up gate, and security tests PASS
• writer-lease regression coverage is included in security.test.ts
• mcp-daemon.test.ts: 8/9 PASS; the remaining Windows-only failure is teardown EBUSY while removing its temporary directory, outside the files changed by this PR
• diff against current main: 7 intended files only

The PR remains draft while upstream CI and maintainer review run.