fix: release stranded bootstrap locks and handle re-entrant reacquire (#1351)

[dpearson2699]

Summary

• Release session lock on bootstrap failure paths so it doesn't strand after guided-flow aborts
• Handle re-entrant acquireSessionLock() by releasing the old proper-lockfile handle first, preventing stale onCompromised callbacks from poisoning the new lock
• Reset _lockCompromised on retry acquire path for belt-and-suspenders safety
• Wrap post-acquire bootstrap body in try/catch to release the lock on unexpected errors

Test plan

• session-lock-regression.test.ts — all 10 tests pass (2 new: re-entrant acquire, re-entrant artifact refresh)
• auto-lock-creation.test.ts — all 12 tests pass (1 new: bootstrap cleanup releases artifacts)
• session-lock.test.ts — all 23 existing tests pass
• Manual: fresh repo /gsd → abort discussion → /gsd auto → starts cleanly without "Session lock lost"

Closes #1351

[trek-e]

Heads up — potential merge conflict: PR #1367 also modifies auto-start.ts and session-lock.ts with fixes for #1348 (recursive dialog loop + retry lock onCompromised handler). Please coordinate before merging to avoid conflicts.

[dpearson2699]

@trek-e as of right now my pr has no merge conflicts with main. if you merge yours in first then I'll fix the merge conflicts