bug(state): prevent session metadata loss across concurrent CLI invocations

[pinion05]

Summary

Session metadata is stored via read-modify-write of the entire sessions.json file.

Why this is a problem

agentty is designed around separate CLI invocations plus a background worker. When two processes update session state at the same time, the last writer can overwrite the earlier update.

Impact

• Session records can disappear during overlapping start/exit flows.
• active-session-id can become stale.
• Operational state can drift from reality even when each individual command succeeds.

Suggested direction

• Move to per-session files, or
• Introduce locking / serialized writes for shared state updates.
• Add concurrency-focused tests for overlapping upsertSession and active session writes.

Relevant code

• src/state.ts#readSessions
• src/state.ts#writeSessions
• src/state.ts#upsertSession
• src/state.ts#writeActiveSessionId