Add auto-review coordination locks

[shiny-code-bot]

Why

Part of #130. Codex Lab needs the durable auto-review store to have the same kind of cross-session coordination foundation that Every Code used: a repo-scoped review.lock for ownership and a repo-scoped snapshot.epoch for detecting stale snapshots after repository mutations.

This PR intentionally lands the primitive only. Runtime scheduling integration is deferred to the next #130 slice so the coordination layer can be reviewed and tested on its own.

What Changed

• Adds ReviewCoordination to codex-auto-review, colocated with the existing durable review store at state/review/repo-xxxxxxxx.
• Adds review.lock acquisition with process identity, intent, git head, captured snapshot epoch, and owner-token guarded release.
• Adds snapshot.epoch bump/read support serialized through snapshot.epoch.lock.
• Adds bounded stale recovery for dead-process locks, malformed partial locks, and abandoned epoch locks.
• Adds cleanup-lock protection so stale cleanup cannot delete a freshly replaced lock in a racing process.
• Keeps coordination files beside the scoped auto-review/ store without making AutoReviewStore::has_store_files report durable review data.

Verification

• cargo test -p codex-auto-review
• cargo fmt --manifest-path codex-rs/Cargo.toml --all --check
• git diff --check
• just bazel-lock-update (no MODULE.bazel.lock diff)
• just bazel-lock-check
• Read-only planning/review agents checked the Every Code reference, the initial implementation, the repaired stale-cleanup race, and the final diff.

Note: background auto-review repeatedly failed before producing findings for this branch, with no actionable finding details. This PR was reviewed with independent read-only review agents instead.