Track running -r/--run sessions with a locked PID file

Each bwrap session is now recorded under
$XDG_STATE_HOME/slocker-lite/run/<container-name>-<pid> (falling back
to $HOME/.local/state/...), holding an exclusive advisory flock() for
as long as it's running -- so any tool can tell a stale leftover file
apart from a live session by attempting the same non-blocking flock().
The file is removed once the run ends, on every exit path including a
forwarded Ctrl-C.

run_process_foreground() gained an optional on_start(pid) callback,
fired right after fork() succeeds -- the only point the real bwrap pid
is knowable, since exec() (including nsenter handing off to bwrap)
never changes it. run_bwrap() uses this to create/release the session
lock. The container name comes from read_image_ref(), promoted from a
list_oci_images()-only helper to public API in oci_image.h so
run_container() can reuse the same name/tag derivation for a single
image tar.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Gv3s5jckJKzh6JkMoi2Akz

README.md

@@ -165,6 +165,13 @@ there, `slocker-lite` instead bind-mounts a separate, statically-linked helper
 (`slocker-lite-priv-drop`) into the sandbox and routes the command through it to drop
 privileges before exec.
 
+While a `-r/--run` session is active, its `bwrap` process is tracked as a locked
+PID file under `$XDG_STATE_HOME/slocker-lite/run/` (falling back to
+`$HOME/.local/state/...`), named after the image and its PID so the same image can
+be run concurrently without collisions. The file is removed automatically once the
+run ends; any tool can check whether a session is still alive by attempting the
+same exclusive, non-blocking `flock()` on its file.
+
 See `CLAUDE.md` for the full architecture writeup (file-by-file breakdown, the
 reasoning behind each of the above, and known gaps).