Serialize mobile BLE operations across sessions

[jeremie5]

What changed

• add a synchronous, exact {deviceId, sessionId, operation} lease coordinator for every foreground Ozealis BLE read/write and for connect/disconnect transitions
• make settings, logs, control, calibration, OTA, driver, and delayed-confirmation paths reject stale work after every awaited boundary
• revoke paged CSV transfers before and after each GATT page request/response so invalidation cannot dispatch a later page
• serialize Ozealis and PLX scans across permission/native stop-start awaits, filter queued cross-service results, and make Bluetooth-loss/unmount recovery tombstone stale transition/session ownership
• protect same-device replacements from stale connection cleanup and keep stale finally blocks from clearing replacement busy state
• add executable lease/scan/CSV regressions, AST transport classification gates, CI/local verification steps, and matching protocol/security/release documentation

Why

The UI busy state is render-delayed and could not serve as an atomic lock. Double taps, delayed alerts, reconnects, Bluetooth loss, scan handoffs, paged transfers, and stale async cleanup could therefore overlap or publish against a replacement device session.

Impact

Sensitive mobile BLE work is now admitted synchronously and remains bound to one immutable operation/session identity. Stale work cannot send later writes, request another CSV page, overwrite replacement state, release replacement busy ownership, or revive a scan/connection after teardown. These are app-local lifetime controls; firmware interlocks remain the safety boundary.

Validation

• node scripts/verify-local.mjs
• mobile operation-lease, validation, retained-CSV, and PLX tests
• TypeScript and Expo web-export smoke
• default and bench-PWM PlatformIO builds plus flash-budget checks
• protocol, release-text, documentation-link, Simple-copy, and repository-hygiene gates

The production audit matches the reviewed baseline: 11 moderate, 0 high, 0 critical.