feat: add LeafLock to detect leaf-lock → tree-lock ordering violations (prototype)

[totally-not-ai]

Prototype for discussion — see #25166.

Why

Every one of the recurring shared-signal deadlocks is the same ABBA pair:

• Thread A holds a component's own monitor and calls into a SignalTree, which then takes the tree lock.
• Thread B holds the tree lock (notifyObservers invokes listeners under it) and then needs that component monitor.

These inversions are latent and timing-dependent, so they surface as rare CI flakes or production hangs rather than as test failures. A SignalTree cannot enumerate the arbitrary intrinsic monitors its callers happen to hold, so it can't defend itself.

What changed

LeafLock (new) — a component-level lock that records itself in a thread-local while held. Leaf locks make themselves known so the tree doesn't have to discover them.

SignalTree — asserts (under -ea) that no LeafLock is held when it acquires its own lock, ignoring reentrant tree re-locks. A leaf-lock → tree-lock violation now fails deterministically on the offending thread instead of deadlocking later under load.

UsageTracker.CombinedUsage — migrated to LeafLock, and its ordering fixed: it now registers the per-usage listeners and invokes the downstream listener without holding the leaf lock. This closes a real, reproduced ABBA (a registrar holding the CombinedUsage monitor and wanting the tree lock, versus a committer holding the tree lock and wanting the monitor) that survives the #25166 CachedSignal fix.

The thread-local is cleaned up properly (Sonar S5164): no withInitial(), so the read paths hit on every tree-lock acquisition never create a lingering entry; the deque is created lazily on the first lock() and the entry is removed when the last leaf lock on the thread is released.

Review notes

• Main behavioral change to scrutinize: CombinedUsage.onChange now invokes the downstream listener outside the leaf lock, so concurrent fires are no longer serialized by it. This matches how the downstream listeners (Effect, CachedSignal, nested CombinedUsage) already tolerate concurrent/reentrant invocation — but it is the part worth a close look.
• Effect and CachedSignal are not migrated to LeafLock yet; that's the follow-up if this direction is accepted.

Tests

• The assertion fires deterministically on a leaf-lock → tree-lock violation.
• CombinedUsage survives the register-vs-commit race.
• Full signals suite (650 tests) stays green with the assertion active.

[github-actions]

Test Results

 1 451 files  +1   1 452 suites  +1   1h 26m 30s ⏱️ -26s
10 413 tests +1  10 346 ✅ +1  67 💤 ±0  0 ❌ ±0 
10 849 runs  +1  10 781 ✅ +1  68 💤 ±0  0 ❌ ±0 

Results for commit fe6a260. ± Comparison against base commit 3d61fcf.

♻️ This comment has been updated with latest results.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
88.9% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud