fix: prevent duplicate sessions, audits, and stuck audit logs

[George-iam]

Summary

Three fixes for related audit reliability issues.

Fix 1: Session creation lock (sessions.ts)

• O_EXCL filesystem lock prevents parallel hooks from creating multiple AXME sessions per Claude session
• Spin-wait 500ms on contention, stale lock cleanup (>5s), graceful degradation

Fix 2: Audit spawn dedup (server.ts + session-cleanup.ts)

• cleanupAndExit groups AXME sessions by Claude session ID, spawns one audit per Claude session
• Cross-session concurrent-audit check: if another AXME session with same Claude ID is pending, skip

Fix 3: Stuck audit cleanup (session-cleanup.ts + cli.ts)

• finally block ensures audit log gets phase=failed if neither success nor catch ran
• SIGTERM/SIGINT handlers in audit-session CLI set auditStatus=failed before exit
• SIGKILL covered by existing 15-min stale timeout

Evidence (from this session)

• 156 sessions created, many duplicates for same Claude session
• Paired audits reading identical transcript offsets (wasted LLM cost)
• Two stuck at phase=started forever (b211b61d, 7971ee25)

Test plan

• 103 existing tests green
• Build + type check clean
• E2E: reload VS Code, verify session count +1 (not +5)
• E2E: verify single audit worker spawned per reload
• E2E: verify no new stuck audits (phase=started)