Settings.json concurrent write protection

[dean0x]

Problem

No hooks write to settings.json (confirmed — all hooks are read-only). The risk is CLI-to-CLI only: two devflow commands running in separate terminals could read-modify-write settings.json concurrently, causing one write to silently clobber the other.

Proposed Fix

File-based mutex lock around read-modify-write operations in CLI commands that modify settings.json (e.g., devflow init, devflow memory --enable, devflow ambient --enable).

Scope

• Low priority — requires two CLI invocations racing on the same file
• No hooks involved, no runtime risk