Fix CRC seqNo race across concurrent Notecard requests

[zakoverflow]

Summary

• move CRC stamping until after the Notecard mutex is acquired
• snapshot the transaction seqNo and use that same value for response CRC validation
• add NoteTransaction coverage that asserts seqNo advances before the Notecard lock is released

Testing

• docker run --rm -v /home/ubuntu/.openclaw/workspace/note-c:/note-c -w /note-c ghcr.io/blues/note_c_ci:latest bash -lc 'cmake --build build --target NoteTransaction_test -j && ./build/test/NoteTransaction_test'\n- docker run --rm -v /home/ubuntu/.openclaw/workspace/note-c:/note-c -w /note-c ghcr.io/blues/note_c_ci:latest bash -lc 'ctest --test-dir build --output-on-failure'\n- 166/166 unit tests passed\n\n## Architecture docs\n- No architecture doc update needed; this preserves the existing public locking/concurrency contract and only fixes the internal critical section ordering.