fix(ingest): serialize qoder checkpoint writers and prevent LastLine regression

[sun-970]

Tracking

Refs #139

Consumed requirement revision: #139 R1. This PR must not auto-close the issue; merge and product acceptance remain separate decisions.

Scope

Repairs only the local Qoder checkpoint persistence path on current main. It adds a persistent per-checkpoint OS advisory-lock sidecar, merges competing writes under that lock without allowing LastLine or associated diagnostic state to regress, and replaces the shared *.tmp name with a unique private staging file plus sync and atomic rename.

Traceability

Requirement	Acceptance criterion	Implementation / evidence
REQ-001	AC-001	Lock-held reread preserves the complete higher checkpoint; deterministic independent processes submit 12 then stale 4 and final state remains the full 12 checkpoint.
REQ-002	AC-001, AC-002	Retained sidecar inode uses OS-backed locking (flock / AIX fcntl / Windows LockFileEx); staging uses same-directory CreateTemp; an owner process exits through os.Exit while holding the lock and a waiting writer proceeds after kernel release.
REQ-003	AC-003	JSON schema, caller interface, and normal load behavior are unchanged; only private .lock and transient private temp files are added beside local state.

Validation

• go vet ./cmd/mem/..., gofmt, go build -trimpath ./cmd/mem/... pass.
• Focused independent-process tests pass: TestSaveQoderCheckpointKeepsHighestLastLineAcrossIndependentProcesses, TestSaveQoderCheckpointSerializesAndRecoversAfterOwnerExit.
• go test -race -count=1 pass.
• go test ./... full suite passes.

Risk / rollback

The lock is advisory and applies only to participating mem checkpoint writers on a filesystem with normal OS locking semantics. A live writer can block a later save rather than allowing unsafe lock stealing; existing caller behavior reports a checkpoint-save error and does not advance the cursor. Revert this PR to restore the prior writer. No remote API, transcript format, release artifact, dependency, or repository-setting change is included.

[waterbro-8]

Closing under the fork-workflow decision recorded on 2026-09-03: repository
automation is not being enabled for fork pull requests, so a fork head cannot
carry a CI result, and every acceptance gate in this repository is written
against checks that ran. Nothing in this comment is a judgment that the work is
wrong; where it is right, it is re-landed on an organization branch instead.

#139, re-landed as #140.

A second attempt at the same fix as #141, also from a fork, so it cannot be
given a check result. #140 is the organization-branch version of this change and
is the one to review.

The commits are not lost. A closed fork PR keeps its head ref:

git fetch https://github.com/bytefolk/mem.git refs/pull/155/head:pr-155

Every file in this branch was therefore available to the re-doing work, whether
or not it was used.

[waterbro-8]

Closing as a content duplicate of #140. Mechanical finding, not a judgement on the work.

Diffed head-to-head against b9226a67:

• qoder_checkpoint.go differs only by three removed comment lines; the guard itself is the same (if current.LastLine > cp.LastLine { cp = current }).
• qoder_checkpoint_test.go differs only by four removed comment blocks. Same test function names, same assertions (LastLine still expected to be 12 after the high-then-stale-low interleaving).
• The five qoder_checkpoint_lock_*.go files are byte-identical.
• The remaining delta is CHANGELOG.md base drift (this branches from 10d4bf7a, fix(ingest): serialize qoder checkpoint writers #140 from cc727db0).

So the "prevent LastLine regression" in the subject line describes behaviour #140 already implements and already tests — there is no additional fix here, only the explanatory comments stripped out.

Also worth noting: this head has zero check runs (fork PR at action_required), while #140 has 15/15 green. #139 stays open and is tracked by #140.