fix: lock meta RMW and harden concurrent remix paths

Prevent worker/web clobbering of meta variants via flock and merge-by-id,
make filter timeouts thread-local, harden job-id/stem sanitization, migrate
TemplateResponse API, and remove the compare-bg experiment.

Co-authored-by: Cursor <cursoragent@cursor.com>

tests/test_io_utils.py

@@ -24,3 +24,21 @@ def test_write_json_atomic_roundtrip(tmp_path: Path) -> None:
     write_json_atomic(path, payload)
     assert json.loads(path.read_text(encoding="utf-8")) == payload
     assert not path.with_suffix(path.suffix + ".tmp").exists()
+
+
+def test_file_lock_exclusive(tmp_path: Path) -> None:
+    from concurrent.futures import ThreadPoolExecutor
+
+    from app.io_utils import file_lock
+
+    lock_path = tmp_path / "job.lock"
+    counter = {"n": 0}
+
+    def bump() -> None:
+        with file_lock(lock_path):
+            current = counter["n"]
+            counter["n"] = current + 1
+
+    with ThreadPoolExecutor(max_workers=8) as pool:
+        list(pool.map(lambda _: bump(), range(40)))
+    assert counter["n"] == 40