fix: update AD-002 docs and stale comments to reflect CLAUDE_CONFIG_DIR isolation (#647)

- AGENTS.md AD-002: document per-session CLAUDE_CONFIG_DIR as primary
  OAuth concurrency guard, CLAUDE_EXTERNAL_LOCK as rollback flag
- docker/agents/entrypoint.sh: update stale flock comment
- lib/agent-sdk.sh: move mkdir inside CLAUDE_EXTERNAL_LOCK branch

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docker/agents/entrypoint.sh

@@ -354,7 +354,8 @@ while true; do
   # Fast agents (review-poll, dev-poll) run in background so they don't block
   # each other.  Slow agents (gardener, architect, planner, predictor) also run
   # in background but are guarded by pgrep so only one instance runs at a time.
-  # The flock on session.lock already serializes claude -p calls.
+  # Per-session CLAUDE_CONFIG_DIR isolation handles OAuth concurrency natively.
+  # Set CLAUDE_EXTERNAL_LOCK=1 to re-enable the legacy flock serialization.
   for toml in "${DISINTO_DIR}"/projects/*.toml; do
     [ -f "$toml" ] || continue