fix(persist): Protect session stores from stale and failed reads

[mhiro2]

Summary

• Sync saves now queue behind in-flight async updates and fail on timeout instead of overwriting them, including when requested from a save callback.
• An unreadable, undecodable or unknown-version session store is never replaced with an empty one, and reads no longer truncate a file swapped in by an atomic rename.
• Counts, sizes and durations in the config must be finite integers, and every invalid section or value falls back to its defaults with a warning that says so.

Changes

• 94238fb : fix(persist): keep sync saves ordered behind slow async writes
  • Sync updates join the ordered update queue and run with blocking I/O on their turn; they are withdrawn and reported as failed if the queue does not drain within one second.
  • The queue is released before completion callbacks, so a sync save from a PeekstackSave handler or on_done does not wait on its own caller.
• 1ac1edd : fix(persist): keep the session store intact when it cannot be read
  • I/O errors, invalid JSON, non-object JSON and unsupported versions abort save/delete/rename and leave the cache untouched; only a missing file counts as an empty store.
  • Reads go to EOF on the opened descriptor instead of a size from an earlier stat.
• 61d1ee3 : fix(config): require finite integers for counts, sizes and durations
  • Fractions, NaN and infinities are rejected for integer settings such as persist.max_items, which previously emptied saved sessions; ratios reject NaN too.
  • ui.path.max_width uses the same validator, and its warnings now name the fallback value.
• 3518bd4 : fix(config): fall back to defaults when persist.auto is not a table
  • A non-table persist.auto gets the same default fallback and warning as other sections.
• a6b7612 : docs: describe store read failures, save on leave timeout and integer settings
  • README and :help peekstack cover store read-failure protection, the save-on-leave timeout and integer-only numeric settings.