Fix #107: atomic pretool latch + atomic writes in SeenStore - #123

The PreToolUse latch was a check-then-set across two file operations,
so N parallel hook processes at session start could all observe
pretool_fired == False and all proceed with the full retrieval — four
sqlite connections, four Ollama embeds, and four duplicate injections.
The _save path also rewrote the whole file from a stale in-memory
snapshot with a plain write_text, so process P4's mark_seen would
clobber the entries P1-P3 had recorded and re-inject them next turn.

Replace the latch with an atomic O_CREAT|O_EXCL claim on a sibling
sentinel (context_seen_<sess>.pretool). Callers on the concurrent path
now use SeenStore.try_claim_pretool_fired(), which returns True to
exactly one process per session; the older pretool_fired /
mark_pretool_fired pair is retained for compatibility and now routes
through the same sentinel.

Rewrite _save to write to a temp sibling then os.replace, matching the
existing _atomic_write idiom in install_hooks.py, and rewrite
bump_turn / mark_seen to re-read the on-disk snapshot before merging so
a concurrent writer's entries are preserved. prune_stale's file regex
now also matches the .pretool sentinel so long-lived state directories
don't accumulate them.

mark_seen already re-reads the on-disk snapshot so a concurrent
writer's `seen` entries survive, but it was still stamping newly-marked
ids with the process's local `_data["turn"]`. If another process bumped
the turn between our snapshot and our mark_seen, our entry landed with
a turn value below the file's true current turn, so filter_unseen's
`(turn - last) > reinject_turns` gap opened one turn early and the
item we just marked got re-injected prematurely.

Stamp both the merged entries and the top-level turn with
`max(latest_turn, local_turn)` so the entry's `last_injected_turn` can
never be strictly below the file's current turn. Regression test pins
the exact scenario (A bumps to 1, B concurrently bumps the file to 2,
A.mark_seen must stamp with 2 so a reader with reinject_turns=1 does
not re-inject).

…ch other

The atomic-write helper still derived its tmp name from the session
path (`self._path.with_suffix(self._path.suffix + ".tmp")`), giving
every writer to the same session the same tmp filename. When two
processes' _save() calls interleaved (the very scenario this PR is
meant to harden against), one could truncate the other's in-flight
tmp before the first os.replace ran, and the second os.replace would
then fail on the now-missing shared tmp — silently, because the
BaseException guard swallows FileNotFoundError. Result: one writer's
data lost.

Use tempfile.mkstemp(prefix=<path>., suffix=.tmp, dir=self._dir) so
each _save call gets its own tmp path, mirroring the existing pattern
at runtime/session_marker.py:63. On failure the tmp is unlinked; on
success os.replace consumes it. prune_stale's _FILE_RE now also
matches leftover `.json.<random>.tmp` siblings so a hard-killed
process between mkstemp and replace/unlink doesn't leak tmps forever.

Regression test spies on os.replace and pins that two back-to-back
_save calls hand it two distinct source paths.