Serialize or make direct-import load suppression reentrant

- Two overlapping direct graph imports can close the new load-suppression bracket out of order.
- The second import can then emit replacement graph mutations as human semantic ops into the bound document.
- Make the bracket reentrant, or serialize/cancel graph loads, and cover the overlap ordering.

Exact-head evidence and acceptance criteria

Observed on [`ComfyUI_frontend` PR #16498](https://github.com/Comfy-Org/ComfyUI_frontend/pull/16498) at head `4987eacd8ba45fa2f7327b432770d5e12ac25210`.

`src/scripts/app.ts:2283` opens suppression through `beforeLoadGraph`; the paired `afterConfigureGraph` close is at `src/scripts/app.ts:2427`. `loadApiJson` is public and awaits `nodeReplacementStore.load()` between those points. The downstream mint wiring uses a single open/closed bracket and ignores a nested opener, so this schedule is possible:

1. Import A opens and pauses at replacement loading.
2. Import B reaches `beforeLoadGraph`; its nested opener is ignored.
3. A reaches `afterConfigureGraph`, closing suppression.
4. B resumes and performs `rootGraph.add`, connects, widget callbacks, and arrange while minting is enabled.

Both imports also mutate the same root graph, so their mutations can interleave. The same lifecycle seam is introduced for A1111 imports at `src/scripts/app.ts:2105-2147`.

Acceptance criteria:

- Overlapping direct imports cannot re-enable semantic-op minting until every active replacement load is closed, or imports are structurally serialized/canceled.
- A stale import completion cannot finalize lifecycle state for a newer import.
- A regression test pauses one import, starts a second, completes the first, and proves the second import's graph replacement does not emit human semantic ops.

Review evidence: https://github.com/Comfy-Org/ComfyUI_frontend/pull/16498#pullrequestreview-5077359002