Serialize server election with a flock so only one server spawns

[agigante80]

Closes #14.

Problem

The server election is meant to be bind()-atomic but isn't. spawn.py sets SO_REUSEADDR on the client's bind socket, and SO_REUSEADDR permits a second bind() on the same port while neither socket has called listen() yet. So two sessions connecting at the same moment both bind() and both spawn a server:

1. Server A writes its pidfile, listen()s, and serves.
2. Server B writes the pidfile too — overwriting it with B's pid — then its listen() raises EADDRINUSE; its cleanup (_unlink_own_identity) sees B's own pid and deletes it, wiping the live server A's identity.
3. Both clients then fail verify_server_identity and print server identity check failed … refusing to connect.

This is what made the four two-listener integration tests fail (test_two_clients_exchange_messages, test_send_routes_via_control, test_broadcast, test_list_shows_all_agents).

Fix

Serialize the election with a per-endpoint advisory flock (server.<port>.election.lock). ensure_server_running acquires it via a non-blocking poll that short-circuits on is_server_up (so it never wedges on a stuck holder); the holder re-checks is_server_up, then binds + spawns + waits; losers observe the server come up and return. Only one server ever spawns.

Both prior invariants are preserved:

• server.py still writes identity before listen() (closes the different race where a client's TCP probe succeeds before the pidfile exists);
• SO_REUSEADDR stays (needed for fast rebind after a SIGKILLed server whose connections sit in TIME_WAIT) — it's safe now that the flock guarantees a single binder.

A dead lock holder releases the flock automatically (kernel-released fd lock), so there's no deadlock risk.

Tests

• The four two-listener tests go green — verified stable across repeated runs (20/20).
• New deterministic concurrency test: N threads calling ensure_server_running at once → exactly one server pidfile, identity-verified, all callers see it up (8/8 across runs).

Full suite: 200 passed, 0 failed (previously 3–4 failing from this race).

Notes

Independent of the label/security PRs (branches off main), so it can land standalone.