feat(host-agent): add single-instance lock to prevent duplicate-process dispatch races

Acquire an exclusive, non-blocking filelock on the identity state directory
as the first action of create_application(), before resolve_host_identity()
or any enrollment/heartbeat side effect. A second process against the same
identity_path exits immediately with InstanceAlreadyRunningError naming the
lock path; the lock releases automatically on any process exit (including
SIGKILL) via OS-level advisory locking, and explicitly during run_async()'s
shutdown finally block. filelock is promoted from transitive to direct
dependency (version unchanged at 3.29.7).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/device-host-agent/pyproject.toml

@@ -7,6 +7,7 @@ dependencies = [
     "device-agent-runtime==0.1.0",
     "device-cloud-platform==0.1.0",
     "fastapi>=0.115.0",
+    "filelock>=3.0",
     "httpx>=0.27.0",
     "jinja2>=3.1",
     "uvicorn[standard]>=0.30.0",