persist: kv compare-and-swap + create-only put + 11 tests

kv.sx: persist/kv-cas sets a key only if its current value equals expected,
else returns {:conflict :expected :actual}; persist/kv-put-new is create-only.
The kv analogue of log append-expect — atomic current-state for sessions, acl
grants, stock counts. 133/133.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/persist/kv.sx

@@ -24,3 +24,21 @@
   (fn
     (b key dflt f)
     (persist/kv-put b key (f (persist/kv-get-or b key dflt)))))
+
+; compare-and-swap: set key to new ONLY if its current value equals expected.
+; Returns new on success, or a conflict value {:conflict true :expected :actual}
+; the caller can re-read and retry on. The kv analogue of log append-expect.
+(define
+  persist/kv-cas
+  (fn
+    (b key expected new)
+    (let
+      ((actual (persist/kv-get b key)))
+      (if (equal? actual expected) (persist/kv-put b key new) {:actual actual :expected expected :conflict true}))))
+
+; create-only: put a value only if the key is absent; conflict if it exists
+(define
+  persist/kv-put-new
+  (fn
+    (b key val)
+    (if (persist/kv-has? b key) {:actual (persist/kv-get b key) :conflict true :reason "exists"} (persist/kv-put b key val))))