leader lease: close double-leadership windows (no ref CAS) + heartbeat within long passes

[kristofferR]

The account-wide autoreview singleton uses a GitHub ref (crq-leader) claimed via atomic
create-if-not-exists, with a heartbeat + TTL-steal. Two residual concurrency gaps remain, both
inherent to GitHub refs lacking compare-and-swap:

1. Force-heartbeat window (Codex crq:218): _leader_beat re-confirms ownership then
   force-PATCHes, but a heartbeat delayed past CRQ_LEADER_TTL could still clobber a host that
   legitimately stole the stale ref in the gap between the re-read and the PATCH. The window is now
   small, but non-zero.
2. Heartbeat cadence vs. long passes (Codex crq:915): leadership is refreshed once per pass. On a
   huge scope a single pass can exceed CRQ_LEADER_TTL, letting a standby steal mid-pass → brief
   double-leadership.

Impact is low: the state lock serializes all mutations (no corruption) and dedup/fired-markers
catch duplicate review requests; worst case is brief, self-correcting duplicate scanning.

Proposed options: heartbeat periodically within a pass (not just at the top); cap pass duration;
or move leader election to a primitive that has CAS if cross-host failover at scale matters. For
single-daemon deployments the per-host pidfile already guarantees one daemon. Deferred from PR #1.

[kristofferR]

Implemented in #10 (commit 39f82f0).

The leader lease already uses compare-and-swap in the rewrite (claimed/renewed via store.Update on the state ref), which closes the force-PATCH window from part 1 — there's no create-if-not-exists + force-PATCH race anymore.

For part 2 (heartbeat cadence vs. long passes), autoReviewPass now renews the lease via CAS partway through a long scan (every CRQ_LEADER_TTL/2) and aborts the pass if a standby has taken over, so a pass that outlives the TTL can no longer cause brief double-leadership. Leaving open to close when #10 merges.

[kristofferR]

Resolved by the Go rewrite (#10, merged to main). Leadership is a lease in the typed state, claimed and renewed via compare-and-swap on the state ref ('acquireLeader'/'renewLeader'), and a long scan pass renews the lease partway through (the 'autoReviewPass' heartbeat) so a standby can't steal it mid-pass — closing the double-leadership window without a separate ref CAS.