Make capture writes and retention pruning concurrency-safe

[kcosr]

Capture writes currently target final filenames directly and each writer independently prunes the entire capture directory.

Concurrent writes can therefore:

• race retention pruning, including deleting another writer retained under max_files = 1
• overwrite or corrupt output when a filename template collides across requests
• make retention tests nondeterministic under load

Suggested direction:

• serialize write plus prune per capture directory
• write to a private temporary file and atomically rename
• define collision behavior explicitly
• add concurrent retention and filename-collision tests

This was identified during review of PR #57 but predates that listener and egress work.