Lock during updates, repair duplicate ids, keep file identity on save

- CLI holds a lock file from load to save, so concurrent commands can't
  lose an update; stale locks from crashed runs are taken over
- load() renumbers duplicate ids from the old add() bug instead of
  refusing the file
- save() keeps owner, group and setgid on the temp file, and falls back to
  an in-place write for hard-linked files, files whose owner/group can't
  be kept, and directories that aren't writable

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitignore

@@ -1,6 +1,7 @@
 node_modules/
 todos.json
 *.tmp
+*.lock
 .DS_Store
 
 # Personal Claude Code overrides (not shared)