fix: synchronize TMB session updates #216

Prevent concurrent CLI and auth-agent processes from overwriting a newer TMB session.

• version persisted sessions and replace them with compare-and-swap semantics
• serialize file-store updates with an owner-only lock file
• reload externally rotated state before authenticated requests
• adopt a newer persisted session when another process wins refresh rotation
• prevent stale DPoP nonce updates from restoring an obsolete refresh token
• add tmb logout --local-only --yes for explicit recovery when remote logout is unavailable

Validation covered concurrent refresh and nonce persistence in the test suite, repeated CLI refresh while the LaunchAgent remained active, LaunchAgent restart and crash recovery, and a Spindle VM pipeline using only the TMB-backed auth-agent path. The pipeline completed an authenticated Tangled Issue comment successfully.

Closes #4