fix(email): serialize urgency checkpoint delivery

[RaresKeY]

Summary

This replaces #5655, which GitHub closed during the repository transfer and fork-network separation. The branch has been rebuilt on the current dev history; the implementation scope is unchanged.

Serialize overlapping email-urgency checkpoint decisions without moving async delivery onto a worker event loop. A cancellation-aware cross-process lock now orders the read/decision/publish sequence, while delivery continues on the application loop and checkpoint files are replaced atomically.

Checkpoint reconciliation is scoped to accounts fully covered by the current scan. Account-scoped or failed-account runs preserve unrelated successful delivery state instead of causing later duplicate notifications. Per-account generations also fence delivery and merge work from an older scan after a newer same-account checkpoint commits.

Target branch

• This PR targets dev, not main.

Linked Issue

Fixes #5645

Part of #5637

Type of Change

• Bug fix (non-breaking — fixes a confirmed issue)
• New feature (non-breaking — adds new behaviour)
• Breaking change (changes or removes existing behaviour)
• Refactor / cleanup (behaviour unchanged)
• Documentation only
• CI / tooling / configuration

Checklist

• I searched open issues and open PRs — this urgency checkpoint race is not already owned.
• This PR targets dev.
• My changes are limited to urgency run coordination, checkpoint merging, and focused regressions.
• I ran the app end-to-end. Deterministic scheduler, loop, cancellation, and state tests were used instead of live IMAP and notification services.

How to Test

1. Run:

   python -m pytest -q tests/test_email_urgency_checkpoint.py tests/test_email_oauth.py tests/test_note_reminder_email_oauth.py

2. Start two same-owner urgency actions together and verify the second observes the first checkpoint before deciding to deliver.

3. Cancel a run while it waits or delivers and verify it neither continues in a detached worker loop nor publishes a success checkpoint.

4. Run disjoint account-scoped scans and a failed-account scan; verify unrelated account checkpoints remain intact.

5. Poll browser notifications concurrently and verify an appended reminder is not discarded.

Exact-head validation passes 142 email, urgency, reminder, scheduler, and owner-scope tests, including active-account registration, authoritative cleanup fencing, newer-addition, newer-removal, partial/full, mixed-account, cancellation, and browser-queue orderings. The late-cleanup race also passes 20 consecutive isolated repetitions. Python compilation and diff checks pass.

Visual / UI changes — REQUIRED if you touched anything that renders

No visual or frontend files changed.

• Screenshot or short clip — not applicable; no rendering changed.
• Style match — no UI change.
• No new component patterns.
• I am not an LLM agent submitting a bulk PR. Contributor attestation remains for the human author.