fix: lock private jsonl appends

[ScriptedAlchemy]

Summary

• lock shared private JSONL appends used by hook analytics
• lock automation run-ledger appends and warn when corrupt ledger rows are skipped
• make untracked context memory search use the read-only project-store opener
• report malformed hook analytics rows in diagnostics (rows_malformed, first line/error)
• add regressions for concurrent appends, read-only MCP memory matches, and malformed-row diagnostics

Root cause

Live TraceDecay logs showed malformed JSONL in multiple hook_analytics.jsonl files and one dashboard/automation_runs.jsonl. Both append paths relied on append mode/write_all without an advisory lock, so split writes from concurrent processes/tasks could interleave and corrupt rows. Separately, tracedecay_context memory enrichment called a project-store opener that requires write access, causing read-only MCP serving to render Memory Matches unavailable.

Live log scan

• /home/zack/.tracedecay/hook_analytics.jsonl: 1 malformed row, first line 256
• /home/zack/.tracedecay/projects/proj_b4a8bbe4953823c4/hook_analytics.jsonl: 0 malformed rows
• all /home/zack/.tracedecay/**/*.jsonl: 5 files with malformed rows, all hook analytics or automation run ledger files

Validation

• cargo fmt --all -- --check
• tracedecay_diagnostics workspace: 0 diagnostics
• git diff --check
• cargo test storage::tests::append_line_keeps_concurrent_jsonl_writes_intact
• cargo test context_memory_matches_use_project_store_when_serving_branch_db
• cargo test hook_analytics_sources_report_malformed_jsonl_rows
• cargo test run_ledger
• cargo test --lib

[changeset-bot]

⚠️ No Changeset found

Latest commit: a0f96c0

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR