Sessions: canonical v1 writer and cross-process ownership - #185

Review: approved ✅

The write-side counterpart to #182, and the ordering (read compatibility first, then canonical writes) is correct.

What I checked

• Legacy bytes are never rewritten. Normalization goes into a separate atomic <id>.v1.jsonl sidecar stream on first write. Combined with Sessions: dual-read legacy formats with corruption diagnostics #182's non-mutating reads, this means a bad canonical writer can be rolled back by deleting sidecars, with legacy history intact. That is the property that makes this safe to ship.
• <id>.writer.lock uses create-new semantics in both TypeScript and Rust. Same contract on both sides is essential — CLI and desktop genuinely can run concurrently against one session, and a lock that only one implementation honours is worse than no lock, because it looks safe.
• Listing dedup across generations prevents the same session appearing twice during the transition window.
• Archive/delete operating on both generations is easy to forget and would otherwise leave orphaned legacy files after a user explicitly deleted a session — a privacy-relevant miss. Good that it's handled.
• docs/design/session-format-v1.md documenting stale-lock policy and recovery is what makes this maintainable; an undocumented lock protocol rots fast.

Follow-up worth tracking (not blocking): stale-lock recovery is the part most likely to bite in the field (hard kill leaves the lock behind). The policy is documented; a real crash-and-recover drill would be a good addition whenever the release-gate drills in #208 get exercised.

Validation: CI green; full suite green locally at the stack tip.