pluginDir read-modify-write TOCTOU (otp, capability, shortlink, activitypub) #4

The pluginDir JSON writes are now atomic (temp + rename, commit ca52373). But two concurrent request handlers can still interleave read → modify → write and lose one update: e.g. two capability revocations, two OTP mints, two shortlink claims, or two AP inbox pushes racing.

Distinct from the atomicity fix (which prevents torn files) and from core #600 (the host's own conditional-write non-atomicity).

Fix direction: a per-key (or per-file) async lock / serialized write queue around the read-modify-write. Low impact at scratch scale; accepted-risk in SECURITY.md.