fix: make multiscan supervisor locks safe across container restarts

[kmbroai]

Summary

Bulk-scan supervisor locks previously identified their owner only by PID. Container replacement or PID-namespace reuse could therefore strand durable scan output behind a lock that appeared to belong to a live, unrelated process.

Persist a private owner identity containing a unique owner ID, hostname, PID, and process start time; refresh a bounded filesystem lease while the supervisor is active; serialize stale-lock recovery; retain compatibility with existing PID-only locks; and never let an older supervisor remove a replacement owner's lock. Fresh owners in other containers remain protected even when their PIDs cannot be inspected locally.

This change is limited to multiscan supervisor locking. Package versioning and npm publication remain separate release steps.

Test Plan

• bun test --randomize --seed 12345 --timeout 30000 ./tests-ts: 918 passed, 10 expected platform/integration skips, 0 failed; sandbox-only mount-root ownership was normalized without disabling negative ownership controls.
• bun test tests-ts/multiscan.test.ts: 24 passed, covering live-owner contention, reused live PIDs, replacement containers, expired leases, legacy owners, private permissions, simultaneous recovery, interrupted owner creation/recovery, and ownership-safe cleanup.
• pnpm run types, pnpm run format, and pnpm run build: passed.
• Packed the npm artifact and ran pnpm run check:package against the real tarball: installed SDK import and CLI passed; all 106 bundled plugin files and 198 archive entries validated.