fix(jobs): atomic dot-path writes for file_urls/state_data (lost-update race) - #970

…it races) (#974)

## Summary
Follow-up hardening sweep to the `file_urls`/`state_data` lost-update
fix (#970). An audit found the same **read-copy-mutate-write-whole-map**
pattern in 8 more sites; this converts them to atomic Firestore dot-path
writes so a stale snapshot can't clobber a concurrent sibling key.

## Changes
- **`video_worker` distribution / redistribution / finalize (3 sites)**
— the most dangerous: they rewrote the whole `state_data` map and
`.pop('visibility_change_in_progress')`, so a stale write could **revert
the `worker_generation` supersession fence** (an atomic `Increment`) or
resurrect the visibility guard — the "visibility-recycle-dataloss"
surface. Now dot-path writes, with `DELETE_FIELD` for the guard.
- **Audio-editor undo / redo / apply (`review.py`)** — full-map rewrites
that could race with rapid clicks or the idle-reminder scheduler active
during audio-edit → dot-path writes.
- **Audio-editor upload-for-join** — now writes only *this* upload's
entry via `FieldPath(...).to_api_repr()` (backtick-escapes the
hyphenated uuid, string key), so concurrent uploads **merge** instead of
one dropping the other (which orphaned a GCS file and 404'd on join).
*(CodeRabbit finding #1.)*
- **Deferred YouTube-URL write (`youtube_queue_processor`)** → dot-path.

## Out of scope (documented)
- The two audio-edit **list** fields (`audio_edit_stack` /
`audio_edit_redo_stack`) remain last-write-wins across concurrent edits
to the *same* job — a list can't be dot-path-merged. Acceptable for the
single-reviewer sequential audio-editor UI; true multi-writer safety
needs a transaction/CAS. Documented inline. *(CodeRabbit finding #2 —
deliberately deferred.)*
- Two low-risk fresh-dict-*replace* sites (create-from-search / admin
re-search) — single-request, early-lifecycle — left as-is.

## Testing
- [x] Full backend unit suite green (4266 passed) + emulator suite green
(118 passed).
- [x] New emulator regression tests: distribution write preserves the
`worker_generation` fence + clears the visibility guard (with a contrast
test showing the old full-map write reverted the fence); concurrent
audio-edit uploads both survive.
- [x] Updated the 2 unit tests that asserted the old full-map shape.
- [x] CodeRabbit CLI: finding #1 fixed, finding #2 documented/deferred;
no new findings on re-review.

## Review
- [x] Local CodeRabbit review completed (2 cycles); feedback addressed

@coderabbitai ignore

---
🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>