check_state_writes waives per (file, token), not per call

[mtklein]

tools/check_state_writes.py:7,167: a new write in a file that already holds a waiver passes silently. Waive per call site (or count per file) so every new write is declared.

From the v0.22 release audit (build/attempts/ombudsman-v0.22/).