fix: atomically initialize the shared native storage master

[OskarEichler]

Fixes

• Preserve one shared AES-GCM master across Fetch and optional WebSocket startup.
• Use add-only Keychain insertion and reload the winning duplicate; reject malformed/existing-key read failures without replacing the master.
• Use a shared interned monitor and OS file lock for Android first-key creation, recheck inside the file lock, and leave ordinary existing-key reads off the file-lock path.

Compatibility / breaking changes

• No ciphertext-format, alias, key size, accessibility, queue schema or automatic key-rotation change. Both optional packages need the fix when used together; an old writer is not made safe by upgrading only its peer.
• The documented Fetch plaintext fallback when secure storage is unavailable remains unchanged. WebSocket encryption failure does not gain a plaintext fallback. Existing corrupted data cannot be recovered by this fix.

Verification

• Fresh read-only boundary investigation and independent candidate review completed; the review identified and prompted the cross-process lock.
• 13 Swift/CryptoKit cases pass against mock Keychain/Defaults, including 20 forced cross-package races, malformed keys, transient errors, legacy migration and fallback controls.
• Seven compiled JVM checks plus a two-process OS-file-lock check pass with a mock Keystore provider and real AES-GCM; original race reproductions fail on baseline.
• Real Android/iOS example builds pass. Physical-device Keystore/Keychain execution and restore scenarios remain unverified; mocks are not claimed as device verification.

Fixes #198.

Changes were reviewed against upstream 627c77e. No test/spec files were added or modified. Release/version selection is left to the maintainers.

Consumer verification

All nine independent PR source overlays pass TypeScript. The combined fixes were backported to the existing 1.6.1 package without upgrading its dependency constraints. Both Android/iOS app variants, four production Metro bundles, 13 web builds, four extension builds and app lint pass. The installed artifact is immutable and its 269 non-metadata files match the build-verified candidate.

[vercel]

@OskarEichler is attempting to deploy a commit to the Margelo Team on Vercel.

A member of the Team first needs to authorize it.