Make Claude picker ownership crash-safe

[andy-xu-db]

🥞 Stacked PR

• stack/codex/persist-model-location [Files changed]
  • stack/codex/managed-model-location [Files changed]
    • stack/codex/claude-picker-ownership [Files changed] ← this PR

---

Summary

• Make transitions into and out of managed Claude modelPicker settings transactional across private settings, OS-managed settings, ownership state, and web-search registration.
• Preserve unrelated user/admin settings, prove legacy ownership before cleanup, and use durable acquisition/revert state for retry-safe crash recovery.
• Serialize configuration and MCP registration across threads and processes with POSIX- and Windows-compatible advisory locks released before Claude starts.
• Keep managed-file restoration manifest-first, fail closed on malformed private JSON, and preserve current-main managed smart-routing and OTLP behavior.

Scope boundary

• Depends only on Support managed Unity Catalog model locations #675 in the independent model-location/picker-safety stack.
• It does not define, read, or transport UG_ENABLE_MODEL_DISCOVERY.
• The lock protects only short-lived configuration transactions and never reads, writes, primes, or locks Claude's gateway-models.json.
• Refresh Claude model cache before scoped launches #622 is not an ancestor and is not part of this stack.

Verification

• Head: 9642d7aa664c587982d3694ddfd50843e4e9d1f0.
• Focused final-tip suite: 1,074 passed.
• Full local stack: 2,540 passed and 42 skipped, excluding the native-binary capture test whose two environment-dependent failures reproduce on main.
• Independent risk review: SHIP after concurrency, crash-recovery, stack-isolation, and version-gate review.
• Ruff, formatting, and git diff --check passed.