system: make settings stores opaque and transactional

[turinglambdaai]

Closes #218.

Makes settings-store an opaque synchronized handle before 1.0 and turns its documented atomicity into a complete transaction contract:

• Removes the public constructor, representation accessors, and mutable setters while retaining settings-store? and controlled operations.
• Shares an in-process semaphore by normalized path and adds an operating-system file lock for cooperating processes.
• Refreshes from disk inside every transaction so two handles cannot overwrite one another from stale caches.
• Deeply freezes stored JSON values and returned snapshots, including nested hashes/lists/strings.
• Documents the persistent empty lock sibling and adds multi-handle/mutable-input regression coverage.

The branch is rebased on the merged managed-updater API. Local evidence after forced recompilation: 9,066 Racket and Taskboard tests pass in an isolated temporary Racket environment.