perf(newos4): delegated agent runs no longer serialise; a waiter can't steal a lock

Closes the second half of STEER-20261102-201045-ab08.

- chat() gated the main-turn lock on nothing, so orchestrate-parallel's fan-out
  (each sub-task calling chat() on the same instance with its own agentTag) ran
  strictly one at a time. Measured 2x300ms delegated runs: 617ms before, 306ms
  now; the two 200ms user turns still take 400ms (main path stays serialised).
- the 10s lock timeout called this._chatLock = false and printed "force
  released", which cleared a lock the waiter did not own - that released the
  main turn's lock while it was still running. A waiter now throws and the owner
  is the only writer.
- delegated runs no longer clear the user's cancel flag on entry (an agent start
  used to reset this._cancelled, disarming a Stop the user had pressed).
- tool-log entries carry the run they belong to and _recentToolLog(tag, n) is
  what feeds the run log line and _postRunReview, so concurrent runs no longer
  consume each other's entries.

Known limit, unchanged: _currentTag is a single field, so under true concurrency
an entry can be attributed to the wrong run (telemetry only - the answers are
per-session). Namespacing it properly needs per-call state threading.

Test: modules/test/test-chat-concurrency.js, 7 assertions, RED before
(H1 617ms, H3 force-released, H5 no tags) and GREEN now; maintain 24/24.

1 files changed, 1 insertions, 1 deletions

diff --git a/modules/core/module-loader.js b/modules/core/module-loader.js
index eb916d1..7206155 100644
--- a/modules/core/module-loader.js
+++ b/modules/core/module-loader.js
@@ -4,7 +4,7 @@
     // Core module bundle loaded synchronously in main.html.
     // This loader only handles version cache-busting, splash, terminal init, and optional ext modules.
 
-    const LATEST_VER = 'v4.6.138';
+    const LATEST_VER = 'v4.6.139';
     const CACHE = '?v=' + LATEST_VER;
     // Exposed so ext modules can register their own URL with the same cache-busting version
     // instead of an unversioned path the browser may already have cached (shell.js did).