Implement neighbourhood reserve (RSV rows, llm_id + TTL) #30

Summary

Implement neighbourhood reserve so parallel agents on one shared session_id can hold disjoint pin-map ego scopes without logical lost-update. Design is landed; engine and MCP tools are not shipped in 0.4.x.

Design SSOT

• docs/grammar/memnet-neighbourhood-reserve.md
• Composes with session ACL in docs/grammar/memnet-security-multi-agent.md (ACL gates session join; reserve gates mutate within an authorised session)

Traceability

• MN-REQ-12.7 — agents must not assume reserve is available (sysml-models/models/requirements.sysml)
• MN-VER-12-S09 / group MN-VER-12-G00 (sysml-models/models/verify.sysml)
• Product backlog: docs/multi-agent-sessions.md (Not implemented table)
• CHANGELOG.md Unreleased — deferred with ACL / ingest / WorkerWriteScope

Acceptance criteria (draft)

• MCP (or equivalent) reserve / extend / release with holder llm_id and ttl_s; scope = anchor + depth matching pin_map
• Store or gate rejects mutates that touch ids outside the holder's leased neighbourhood (or overlap with another holder's lease)
• Pin map may surface RSV present lines per design (shared dialect; no pipe wire)
• Tests aligned with verify step S09 once engine behaviour exists
• Document interaction with Multitask doctrine (docs/multi-agent-sessions.md) — reserve is after ACL when both exist

Related

• TCP memnet serve: no session token or ACL (post-0.3.6 hardening) #28 — session ACL / session_token (prerequisite in design ordering)
• MutateGate: batch rollback does not undo rename_id on failure #27 — unrelated MutateGate rollback bug