singleton: guard the state, not the program's name

The singleton lock protected a filename, not a store. It was keyed on
$EL_SINGLETON_DIR|$TMPDIR|/tmp + /el-singleton-<program>.lock — the
program's NAME and a temp directory — and never consulted the state it
claimed to protect, while its own refusal message read "Refusing to start
a second instance against the same state."

Measured, it failed in both directions. A second engram against a
DIFFERENT data dir was refused, naming the first's pid. And
TMPDIR=/tmp/other let a second engram start against the SAME data dir
with no complaint — the two-writer data-loss condition the guard exists
to prevent, defeated by one environment variable.

Both are one error: the identity of the resource had been replaced by a
label for it.

The lock now lives inside the state it guards —
<state>/.el-singleton-<id>.lock — and the program block says what that
state is. Same directory is the same file is the same inode, so it
contends and there is no TMPDIR left in the key to change. Different
directories are different files, so they don't. Different spellings of
one directory (trailing slash, x/../x, symlink) collapse in the kernel's
own path walk, so they contend without this code comparing strings;
canonicalisation is for the message, never the decision.

`guards:` is an expression so a program can point at the resolver that
already owns its path — guards: engram_resolve_data_dir() — instead of
restating that resolver's default, which is the two-owners defect spec
18.4 exists to prevent. A `singleton:` without `guards:` is now a compile
error; emitting a name-keyed lock instead would be emitting the defect.

Kept: the flock (the kernel drops it on crash and SIGKILL, so there is
still no "delete the lock file to get unstuck" ritual — a stale file
inside a copied data dir is inert), and the holder's pid in the message.
Changed: the message is true. It says "the same state" because the lock
it failed to take is in that state, and it names the state it checked.
An unguardable state (missing, read-only) now refuses rather than
starting unguarded.

Also corrects lang/AGENTS.md's compiler rebuild line, which had gone
stale: linking el_runtime.c alone no longer resolves.

lang/el-compiler/src/codegen.el

@@ -3295,6 +3295,12 @@ fn cgi_arg(value: String, has_value: Bool) -> String {
 //      exit before touching configuration, ports, or any data directory.
 //   2. config declarations — resolve env-or-default, one declaration per entry.
 //   3. validate LAST — report EVERY missing/ill-typed entry at once, then exit.
+//
+// `singleton:` carries its `guards:` expression as its SECOND argument — the
+// state the lock protects, evaluated here at the process boundary. A singleton
+// without one does not compile (see below): a lock keyed on the program's name
+// rather than on its state refuses unrelated instances and permits concurrent
+// ones, which is not a weaker guard but a wrong one.
 fn el_bool_arg(b: Bool) -> String {
     if b { return "EL_INT(1)" }
     return "EL_INT(0)"
@@ -3306,7 +3312,16 @@ fn emit_program_init(stmt: Map<String, Any>) -> Void {
     let has_singleton: Bool = stmt["has_singleton"]
     if has_singleton {
         let sid: String = stmt["singleton"]
-        emit_line("  el_singleton_acquire(EL_STR(" + c_str_lit(sid) + "));")
+        let has_guards: Bool = stmt["has_guards"]
+        if has_guards {
+            let guards_c: String = cg_expr(stmt["guards"])
+            emit_line("  el_singleton_acquire(EL_STR(" + c_str_lit(sid) + "), " + guards_c + ");")
+        } else {
+            // Refuse at COMPILE time. The alternative — emitting a name-keyed
+            // lock — is the defect itself, and it fails silently in the direction
+            // that loses data.
+            emit_line("#error \"singleton '" + sid + "' declares no `guards:` — a singleton must name the state it protects, e.g. `guards: engram_resolve_data_dir()` (spec 18.2)\"")
+        }
     }
     let entries = stmt["entries"]
     let n: Int = native_list_len(entries)