fix: guard AppStore state stamps with CAS

[NikolayS]

What changed

• add a local crash-recoverable mutation lock to AppStore
• add whole-record compareAndSwap(expected, replacement)
• use CAS for deploy bookkeeping and release-tag cursor/channel stamps
• add RED/GREEN coverage for stale deploy stamps, CAS conflicts, live locks, and dead-process lock recovery

Why

Deploy and trigger work can spend time in CI and remote execution after reading an AppRecord. Their final unconditional upsert could overwrite a newer SHA, release cursor, or configuration update made by another local samohost process. The new CAS stamp fails closed when the persisted record no longer matches the snapshot.

The filesystem lock is held only for the short local read/check/atomic-write section, not across network or SSH work. Existing atomic .tmp/fsync/rename persistence remains the write mechanism.

Scope

This is the standalone state-safety prerequisite only. It contains no Caddy or project-routing script changes and is not bundled into #153. A later routing slice can use the same whole-record CAS when stamping its routing fingerprint.

Validation

• bun test test/app-store-cas.test.ts test/app-command.test.ts test/trigger.test.ts — 92 pass
• bun test — 1864 pass
• bunx tsc --noEmit — pass
• git diff --check — pass

[samo-agent]

samorev Code Review Report

• PR: fix: guard AppStore state stamps with CAS #156 - fix: guard AppStore state stamps with CAS
• Author: @NikolayS
• AI-Assisted: Unknown

Pipeline	Coverage
PASS	Not reported

---

BLOCKING ISSUES (1)

HIGH MR/PR state - Review target is draft

The review target is still marked as draft.
Fix: Mark it ready for review before merge.

---

Summary

Area	Findings	Potential	Filtered
CI/Pipeline	0	0	0
Security	0	0	0
Bugs	0	0	0
Tests	0	0	0
Guidelines	0	0	0
Docs	0	0	0
Metadata	1	0	0

Note:

• Findings: High-confidence issues (8-10/10) - blocking or non-blocking per severity
• Potential: Medium-confidence issues (4-7/10) - review manually
• Filtered: Low-confidence issues (0-3/10) - excluded as likely false positives

Review metadata

provider=github
kind=pr
project=NikolayS/samohost
number=156
target=github:NikolayS/samohost#156
state=OPEN
draft=true
diff_lines=473
diff_added=338
diff_removed=17
diff_bytes=15374
comments_count=0
commits_count=2
ci_status=success
ci_summary=total=1 success=1 failure=0 pending=0 other=0
prompt=.claude/commands/review-mr.md
blocking=true
posted_by=gh
no_comment=false
live_posting=posted

---

samorev-assisted review (AI analysis by Tanya301/samorev)