[P2][cli] CLI lock ownership with pid/host/nonce and safe --force #33

Summary

CLI advisory lock (src/cli/lock.ts) writes only a static sentinel. release() deletes any lock file regardless of owner. Two --force writers can both acquire; neither owns the lock exclusively.

Audit ID: Section 2 Med — Wave 2
Related: Kernel exclusive open lock (B4 issue)

Root cause

release() {
  rmSync(lockPath, { force: true });
}

No pid/host/nonce in lock file; no verify on release.

Fix

1. Lock file content: libredb-lock\n<pid>\n<hostname>\n<random-nonce>\n
2. release() — read and verify nonce matches; only then delete.
3. --force — check prior lock holder liveness (pid signal 0 / stale detection) before dropOwnLock; refuse if alive holder unless explicit force semantics documented.

Align format with kernel-level lock (B4) if shared constant extracted.

Tests

• Acquire + release own lock → ok.
• Simulate foreign lock content → release must not delete (or force path only).
• --force on stale pid → succeeds.

Acceptance criteria

• Lock ownership verified on release.
• --force cannot leave two live writers thinking they hold lock.
• bun run gate green.
• Changeset if CLI behavior changes (yes).

Verification

bun run gate