feat: concurrency-safe append claim and run commands

[anusbutt]

Fixes a read-modify-write race on graph/claims.json and graph/runs.json where two concurrent agents silently dropped one writer's record.

What changed

• Shared helper (src/lib/optimistic-write.ts): mutateJsonArrayFile / acquireLock / writeJsonArrayUnderLock — exclusive graph-file lock (atomic hard-link) + compare-before-rename + bounded retry (default 5).
• CLI commands (src/commands/append.ts, wired in src/cli.ts): graphkeeper append claim and graphkeeper append run. append claim acquires claims.json then runs.json locks up front and writes both in one critical section, so a run closed mid-flight cannot orphan a claim.
• Diagnostics: GK400 (write did not stabilize / lock timeout), GK401 (invalid input).
• SKILL.md now prescribes the append commands in place of direct JSON editing.

Verification

• 50-trial staggered stress (400 concurrent appends): 0 lost records, 0 failures.
• Full functional suite: 357 pass, 0 fail. typecheck, validator:check, package smoke clean.
• Targeted mid-flight-close test confirms no orphaned claim (both files asserted).

Notes

• specs/, .specify/, PROGRESS.md are git-ignored local SDD artifacts (not in the PR).
• Does not touch entities.json write path or per-record storage (out of scope).