feat(sessions): add project-wide atomic session mutation support

[mrbdahlem]

Problem

The shared session API currently exposes independent get and set operations. Concurrent read-modify-write handlers can therefore overwrite each other, even in one Node process; the risk increases with multiple instances. MobCode workspace, sharing, and durable-state writes are a concrete example.

Goal

Add a project-wide atomic session mutation capability to the shared session-store contract. It must provide safe read-modify-write behavior for both in-memory development/test storage and Valkey-backed production storage.

Acceptance criteria

• Extend the shared session-store contract with an atomic mutation operation or equivalent compare-and-set primitive.
• Implement it for the in-memory store with per-session serialization.
• Implement it for Valkey using an atomic server-side operation while preserving session TTL and normalization behavior.
• Define cache invalidation/refresh behavior so callers do not observe stale session state after mutation.
• Provide concurrency tests for both implementations, including conflicting updates to different fields of one session.
• Migrate MobCode whole-session read-modify-write routes to the primitive as the first consumer.
• Document deployment and scale-out assumptions.

Notes

A process-local activity mutex may be a short-term single-instance mitigation, but it is not a substitute for a shared atomic primitive before multi-instance deployment.