Second review round (adversarial + testing trailing reports):
- Serialize every state read-modify-write with an OS advisory lock so a
lease-agnostic write (aborted-locked run-record) cannot clobber the
mid-sweep holder's upserts and drop an acknowledged item
- Compare pure-digit cursors numerically so '9' precedes '10'
- import-legacy --source-map lands legacy cursors under the configured
source id (else the migration is silently ineffective and re-ingests)