Atomically claim a work item for a session (T879)

Cross-machine atomic claim. The conditional UPDATE's WHERE clause is the lock, so exactly one concurrent caller wins. Losing is a 200 with claimed: false naming the holder, NOT a 409 — a fanned-out agent treats an error status as a transport failure and retries, while "someone else has it" is a final answer to act on. The claim does not move status; status is advanced through /advance.