fix(coding-agent): avoid project trust read contention

[JeremyDev87]

What changed

• Removed writer-lock acquisition from project trust reads.
• trust.json writes keep the existing proper-lockfile serialization but publish through a same-directory temp file and an atomic rename.
• Added a regression test that reads the stored trust decision while a real writer lock is held.

Why

When several Senpi/OMO processes run concurrently, a read-only project trust lookup could contend with the writer lock and kill the process with Lock file is already being held. A completed previous snapshot is safe to read, so there is no reason for a reader to wait on the writer lock.

How

The reader reads the last published snapshot directly and validates it with the existing strict parser. The writer performs read-modify-write inside the lock, writes complete JSON to a temp file, and renames it. The fail-closed semantics for malformed snapshots and for the trust default are unchanged.

Verification

• npm --prefix packages/coding-agent test -- test/suite/regressions/project-trust-lock-contention.test.ts test/trust-manager.test.ts PASS (3/3)
• bun run check PASS
• The source CLI --list-models exits 0 while a real proper-lockfile writer holds trust.json.lock
• Senpi CLI smoke PASS (8/8), real auth files unchanged

Out of scope

Credential/settings lock policy and the trust decision itself are unchanged. The 18 tool-protocol leak scenarios in the full mock-loop self-test are pre-existing failures unrelated to this path and were left as-is.

Closes #1393

---

Summary by cubic

Fixes project trust reads retrying the writer lock synchronously and throwing ELOCKED, which could kill concurrent processes. Reads now use the last atomically published trust.json snapshot without acquiring the lock, while writes keep proper-lockfile serialization and publish via temp file plus atomic rename.

• Adds a regression test that reads trust while a real writer holds the lock.
• Updates changes.md with the change details and expected merge conflict zones.

^{Written for commit f20ffa9. Summary will update on new commits.}

[JeremyDev87]

Requesting review.

• RED: with a real proper-lockfile writer holding trust.json.lock, the existing ProjectTrustStore.get() raises ELOCKED
• GREEN: after the lock-free snapshot read, the same scenario returns the stored decision
• Focused tests 3/3 PASS
• bun run check PASS
• The source CLI --list-models exits 0 while the live writer lock is held
• CLI smoke 8/8 PASS, real auth unchanged
• Independent code review: APPROVE

The change is limited to removing the reader lock and publishing writes via a same-directory temp file plus rename; the trust decision and malformed-input fail-closed contracts are unchanged.