feat: add per-team concurrency guard to TaskClaimer.advance_dag

[mvillmow]

Summary

• Adds TaskClaimer class at src/keystone/task_claimer.py with a two-layer per-team concurrency guard
• _advancing: set[str] provides an O(1) coalesce/skip check: concurrent calls for the same team return [] immediately with a log message instead of queuing
• _team_locks: dict[str, asyncio.Lock] provides mutual exclusion over the full fetch→find→claim cycle
• async with + finally guarantee the lock and _advancing entry are always released, even when get_tasks or claim_task raises

Test plan

• test_advance_dag_claims_ready_tasks — basic happy path, all tasks claimed
• test_advance_dag_empty_team_returns_empty — no tasks, no claim attempts
• test_advance_dag_partial_claim_failures — failed claims excluded from result
• test_concurrent_advance_dag_coalesced — second same-team call skipped while first is in-flight; get_tasks called exactly once
• test_concurrent_advance_dag_different_teams_parallel — different teams proceed independently
• test_advance_dag_lock_released_on_error — exception in get_tasks does not deadlock subsequent calls
• test_sequential_calls_same_team_both_execute — sequential (non-concurrent) same-team calls both execute normally

All 7 tests pass: python3 -m pytest tests/test_task_claimer.py -v

Closes #131

🤖 Generated with Claude Code

[github-actions]

Security Scan Results

• ⚠️ Secret Scanning: No results available
• ✅ SAST: Completed (check Security tab for details)
• ✅ Dependency Scanning: Completed
• ✅ C++ Static Analysis: Completed
• ✅ Docker Image Scanning: 0 high, 21 medium vulnerabilities (acceptable)

Recommendations

• Review findings in the GitHub Security tab
• Check artifact uploads for detailed reports
• Address critical Docker vulnerabilities immediately

---

Workflow: Security Scanning

[github-actions]

CI Summary

Check	Status
Code Quality	✅ success
Sanitizers (ASan, UBSan, TSan, LSan, MSan)	✅ success
Benchmarks	✅ success
Coverage	✅ success

View full run