fix(persistence): serialize fresh migration markers

[willytop8]

Summary

Fix the timing-dependent Windows first-start race exposed by exact-main CI after
the 0.6.8 release PR merged. This keeps the package version at 0.6.8; no tag or
npm package has been published yet.

Root cause

When a project had no session namespace and no legacy state to migrate, each
process skipped the aggregate migration lease and independently published the
shared .migration-v1-complete marker. POSIX rename replacement usually hid
the overlap, while Windows could reject a competing rename with EPERM.

Fix

• acquire the existing aggregate migration lease before publishing a fresh
  namespace marker
• recheck disposal and marker existence while holding the lease
• release the lease in finally
• add a deterministic regression that proves publication waits for ownership
  and that the lease is released afterward
• mutation-protect both acquisition and release
• document the Windows fix and refresh the still-unpublished 0.6.8 release date
  in the changelog

Validation

• pre-fix regression: failed because the fresh path never inspected the
  aggregate lease
• node --test test/session-concurrency.test.js: 3/3 passed
• focused concurrency suite repeated 25 times: 25/25 passed
• mutation contract: 66/66 critical mutants killed
• npm run release:check: passed
  • 330/330 tests passed
  • behavior benchmark 100/100
  • type contracts, source smoke, packed-host, packed-tool, verifier, production
    audit, and package-content gates passed
  • 0 production dependency vulnerabilities
• corrected local tarball: 24 files, 109,876 bytes,
  SHA-256 6a4891450f7c3b0c1a676ba57b01146f07df280b20d445d305097ef704be91de
• clean install of that exact tarball passed all six verifier checks and public
  root/server imports

Release boundary

Do not tag or publish from this branch. After merge, require exact-main Linux,
macOS, Windows, package, and CodeQL checks to pass. Tag the later corrective
merge commit as v0.6.8, then publish the exact tag-workflow artifact.