fix(session): serialize shared session mutations

[lyfmt]

Description

Add bounded serialization for shared session mutations so normal writes on the same user-scoped session do not silently overwrite newer messages.jsonl state.

Related Issue

N/A

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Refactoring (no functional changes)
• Performance improvement
• Test update

Changes Made

• Serialize shared-session non-commit mutations at the session subtree level
• Add bounded wait semantics for session mutation lock acquisition instead of pure fail-fast conflict handling
• Refresh session state with load(force=True) inside the mutation lock before applying writes
• Protect add_message from concurrent shared-session write races
• Protect update_tool_part from overwriting newer messages with stale in-memory state
• Add regression tests for wait-then-succeed, timeout-then-conflict, and stale tool update overwrite scenarios

Testing

• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• I have tested this on the following platforms:
  • Linux
  • macOS
  • Windows

Local verification:

ruff check openviking/session/session.py tests/session/test_session_shared_mutation.py
ruff format --check openviking/session/session.py tests/session/test_session_shared_mutation.py
pytest tests/session/test_session_shared_mutation.py tests/session/test_session_messages.py -q

Checklist

• My code follows the project's coding style
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• Any dependent changes have been merged and published

Screenshots (if applicable)

N/A