fix(session): atomic file locking to prevent race conditions in all harnesses

[ZJZAC]

Summary

Closes #51

• Add _locked_save_json() to all 10 harnesses' session.py — uses open("r+") + fcntl.LOCK_EX to prevent concurrent writes from corrupting session files
• Update HARNESS.md with session file locking guidance (as requested by @yuh-yang in PR fix(session): add file locking to prevent race conditions in multi-session sync #52)
• Add 5 new tests including a 4-thread concurrent write stress test

The problem

Every harness saved session JSON with bare open("w") + json.dump(). Three compounding bugs:

#	Bug	Impact
1	open("w") truncates before any lock is acquired	Concurrent opens zero the file even while another process holds a lock
2	No locking at all in current code	Concurrent json.dump() calls interleave bytes → invalid JSON
3	No flush() before close	Data may not be written to disk when another process reads

The fix

def _locked_save_json(path, data, **dump_kwargs) -> None:
    f = open(path, "r+")          # no truncation
    fcntl.flock(f, fcntl.LOCK_EX) # exclusive lock
    f.seek(0); f.truncate()       # truncate INSIDE the lock
    json.dump(data, f, **dump_kwargs)
    f.flush()                     # flush BEFORE releasing
    fcntl.flock(f, fcntl.LOCK_UN) # always released in finally

Key properties:

• No pre-lock truncation — "r+" mode avoids zeroing the file before the lock
• Truncate inside lock — safe against concurrent readers
• flush() before unlock — ensures data is written before other processes can read
• finally block — lock is always released, even on exceptions
• Windows fallback — fcntl import failure gracefully falls back to unlocked writes

Files changed (12)

• */agent-harness/cli_anything/*/core/session.py — all 10 harnesses
• cli-anything-plugin/HARNESS.md — added session locking guidance
• gimp/agent-harness/cli_anything/gimp/tests/test_core.py — 5 new tests

Design decision: local copies, not a shared package

Per discussion in PR #73, the _locked_save_json function is kept as a local copy in each harness rather than a shared package. This avoids adding distribution complexity for a single utility function.

Test plan

• All 1,051 existing unit tests pass (10 harnesses verified locally)
• 5 new tests added: basic save, overwrite, truncation, parent dir creation, 4-thread concurrent stress test
• All 69 gimp tests pass (64 existing + 5 new)

🤖 Generated with Claude Code

[yuh-yang]

A mirror of #73.

I'm merging this one which is cleaner and less noisy.