Make cached review state bounded and concurrency-safe

[itsjling]

What to build

Keep concurrent reviews from replacing newer state and give users safe control over persistent caches.

Acceptance criteria

• Two active writers for the same target cannot silently replace newer notes with older results.
• The lock or session design recovers from crashes and still permits read-only viewers.
• Cache commands show location, size, age, and active use, then support safe age and size pruning plus explicit clearing.
• Tests cover delayed out-of-order writers, stale ownership, active-run protection, and private cache permissions.

Blocked by

• Preserve target repos and make note provenance exact #19