fix: serialize issue-ledger transitions + validate ForceID (iss-71)

[REPPL]

Resolves iss-71 (native ledger) — two ledger-mutation-safety fixes found by the clean-slate sweep.

The bugs

• C4 — split-brain (FIX-FIRST). abcd capture resolve/wontfix ran their find→read→move with no ledger lock (only id allocation locked). Two concurrent conflicting transitions on one issue — a resolve and a wontfix — could both pass commitTransition's checksum re-read before either removed the source, landing the issue in two status directories at once. From then on findIssue always returns ErrDuplicateIssueID and the issue can never be transitioned again.
• P13 — ForceID traversal (FIX-FIRST). reservePath built a path from and O_EXCL-created a placeholder for a migrator-supplied ForceID before validating it. A traversal id (../../evil) escaped the ledger open/ dir (swept only on the later validation failure).

Fixes (internal/core/capture)

• Refactor first (separate commit): extract withLedgerLock from reservePath — the flock-acquire/release primitive — so a second mutator can share it (reuse-before-reinvent; behaviour-preserving, suite stays green).
• C4: transition's find→read→commit critical section now runs inside withLedgerLock, the same lock allocation takes. The second of two racing transitions acquires the lock only after the first has moved the issue out of open/, so it sees status != open and conflicts cleanly.
• P13: ForceID is validated against ^iss-[0-9]+$ before any filesystem op.

Tests (TDD, each watched fail→pass)

• TestTransitionSerializesOnLedgerLock — with the ledger lock held externally, Resolve returns ErrAllocatorContention and leaves the issue in open/ (deterministic; a short lockTimeout override). Fails on revert (lock-free Resolve succeeds).
• TestReservePathRejectsUnsafeForceID — traversal/space/newline/non-id ForceIDs all rejected before any fs op; no escaped file. Fails on revert.

make preflight + make record-lint green; capture package green under -race. Reviewed: ruthless-reviewer SHIP, security-reviewer PASS (both attacked every interleaving and the anchor-bypass classes).

Not in scope (noted by review)

The capture content write happens outside the lock (only the placeholder reservation is locked). A transition racing a mid-capture zero-byte placeholder reads empty content and fails parseFrontmatterAndBody → errors out safely, so it cannot move an empty file. Pre-existing and fail-safe; this change neither regresses nor fixes it.

Assisted-by: Claude:claude-opus-4-8