N4/E2 review fixes: close a gift-enabled equip dupe; harden vault writes

A high-effort code review of the gifting/vault work turned up three issues:

1. Item duplication (real exploit). The masterwork/arena equip confirmation
   captures an item at prompt time and equips it on "yes" without re-checking
   ownership. Since MasterworkGear/ArenaGear are now giftable, a player could
   !give the item away in the window, then confirm — minting a copy onto
   themselves while the recipient kept theirs. Fixed by taking the user lock
   (making gift-vs-confirm atomic) and re-loading the inventory to refuse an
   item that is no longer ours. Magic items are exempt (not giftable); other
   delete paths load-and-remove within one locked invocation.

2. clearAdvInventory read the vault-filtered list but its DELETE wiped every
   row including vaulted ones — no live caller today, but it would break the
   vault's "safe from !sell all" promise the instant sell-all routed through
   it. Delete now matches the read (in_vault = 0).

3. vault store/take took no per-user lock, so two near-simultaneous stores
   could both pass the capacity check and overfill the 10-slot vault. Now
   serialized on the same user lock the gift path uses.

go test ./... green; golden byte-identical.

Claude-Session: https://claude.ai/code/session_017mEwUmmS7aQTP2NQXj6rUa

internal/plugin/adventure_character.go

@@ -613,7 +613,10 @@ func clearAdvInventory(userID id.UserID) ([]AdvItem, error) {
 		return nil, err
 	}
 	d := db.Get()
-	_, err = d.Exec(`DELETE FROM adventure_inventory WHERE user_id = ?`, string(userID))
+	// Delete only what loadAdvInventory returned — vaulted rows are out of play
+	// and must survive a bulk clear, or the vault's whole promise (safe from
+	// !sell all) breaks the moment any caller routes sell-all through here.
+	_, err = d.Exec(`DELETE FROM adventure_inventory WHERE user_id = ? AND in_vault = 0`, string(userID))
 	if err != nil {
 		return nil, err
 	}