Ontology create paths outside ingestion still race; name lock has no timeout #597

#596 serialises ensure_ontology_exists with a per-name advisory lock, closing the #588 race for ingestion and rehydration. Remaining:

1. Unlocked create paths. routes/ontology.py:367 (POST /ontology) and proposal_executor.py:221/543/639 (CLEAVE and other annealing creates) still check-then-create. A POST /ontology foo concurrent with an ingest into a new foo can create two nodes. Route them through a locked create helper.
2. No lock_timeout. If the lock holder stalls, every waiter blocks holding a pooled connection; ThreadedConnectionPool (maxconn 20, base.py:69) raises PoolError on exhaustion. Set lock_timeout on that session.
3. Stale test. test_race_condition_returns_winner (tests/unit/lib/test_age_client_ontology.py ~366) now exercises the under-lock re-check; its docstring and the unique-violation side effect describe the old path. The concurrency test models the lock with threading.Lock; nothing exercises it against real PG/AGE.
4. Unique name constraint can follow once existing duplicates are repaired (ontology list shows operating-models twice #588's operating-models).

From the review of #596.