[P3] Old-shell (writeSync-less) manual-save fallback can be clobbered by an in-flight routed autosave

From the D4 adversarial review (PR #750). On a hydrated session against a shell that predates writeSync, a manual save falls back to localStorage (shared-headed towers only). If a routed async autosave with OLDER bytes is in flight at that moment, its write-through refreshes the cache and the stamp from the older store commit, silently superseding the fallback save in the cache while the store never saw it. Window is one IPC round trip on an old shell; the transitional shell population makes this low-priority, and the mixed store-plus-fallback mode is the root cause.

Wanted: either invalidate the pending routed write''s write-through when a fallback save lands (the latestAsyncSave token pattern one level up), or refuse the mixed mode outright once shells ship writeSync.

Start with the routed async autosave and manual-save fallback described in PR #750, including the latestAsyncSave token pattern and the writeSync availability check. Reproduce the old-shell race with an older in-flight write, then ensure a fallback save cannot be superseded in cache, or that mixed store-plus-fallback mode is refused.