cluster: Confirmations increment uses RLock→Lock dance — collapse to single Lock

[TickTockBent]

Follow-up from PR #136 review.

Problem

internal/cluster/node.go:413-421 reads pendingWrites under RLock then re-acquires Lock to increment. Two concurrent ACKs can both pass the RLock, sequentially Lock, and both increment. Behavior is still correct because signalOnce (added in PR #136 review fixes) absorbs the double-completion, but the pattern is misleading and relies on the safety net upstream.

Fix

Take Lock once for the whole find-and-increment-and-maybe-complete sequence.

Acceptance

• Single Lock spans the read-modify-complete window
• Race test still passes

// ticktockbent