office kill and the host connection writer share one lock per host record #748

Follow-up from the 2026-11-05 post-merge audit of #722, verified against main e9074be (after #738). #738 made office kill remove a host record only when it is byte-identical to the one it re-read; the host connection writer (writeHostState, packages/cli/src/utils/connection-state.ts) and the connector's own shutdown (clearHostState) take no lock, so the two sides are not serialized.

What the fix does: tps office kill and the host connection writer take one shared lock per host state record, and office kill holds it across its final re-read and removal, so a record is removed only when it is byte-identical to the one office kill classified. The connector's own shutdown removes its record under the same lock and only when the record still names its own process.

Test: a deterministic test that writes a successor record between office kill's final re-read and its removal (via the existing test seams) shows the successor is kept and handled (signalled in a later pass or reported), not removed; the existing #738 tests stay green.

Priority: LOW (a live connector rewrites its record on its next heartbeat).