fix(opencode): derive boot sidebar active account from routing mode and preserve live session state (#128)

Boot seeding, quota-only refreshes, and command paths no longer clobber
the sidebar activeId written by a live routing session. Routing-authoritative
writes are distinguished from display-only writes; the serialized write chain
re-reads the file before merging, and cross-process writes are guarded by an
mkdir directory lock (atomic rename-claim eviction, jittered retry, file-based
ownerId release). On lock-budget exhaustion against an active contender the
write is skipped — never performed unlocked. The commit path is fenced:
ownership is re-verified adjacent to the rename and again after it; on
detected post-rename loss, one bounded locked repair republishes only the
frame's routing-authoritative fields into the successor's fresh state. Boot
resolves preserved routing only after the asynchronous account-storage load
completes, so a peer's authoritative publish during the load cannot be
overwritten by a pre-load snapshot. The residual window is a process freeze
exactly between the final ownership stat and the rename — accepted for a
display-only file whose frames self-heal.