fix(lib.sh): add NFS flock warning (FW-02) + unify venv deps with pyyaml (FW-11)

FW-02: atomic_dump_yaml now calls _atomic_dump_yaml_check_nfs() which
  detects NFS/CIFS/SSHFS mounts and warns that flock is unreliable.
  Long-term fix (SQLite WAL) documented in FUTURE_WORKS.md.

FW-11: pyyaml added to requirements.txt and installed in .venv, so
  both paho-mqtt and yaml are available in a single interpreter.
  Eliminates the system-python3-vs-venv split for monitor --subscribe.

skills/lib.sh

@@ -193,8 +193,21 @@ env_python() {
 # The mutation source is passed via env and exec()'d — it is never string
 # spliced and untrusted data never lands in Python source (P0-B / P1-B).
 # ---------------------------------------------------------------------------
+# Check if the workspace is on NFS — flock is unreliable on NFS
+_atomic_dump_yaml_check_nfs() {
+  local f="$1"
+  local mountpoint
+  mountpoint="$(df --output=target "$f" 2>/dev/null | tail -1)" || return 0
+  if mount | grep -q "$mountpoint.*nfs\|$mountpoint.*cifs\|$mountpoint.*fuse.sshfs"; then
+    echo "WARNING: $mountpoint appears to be a network filesystem (NFS/CIFS/SSHFS)." >&2
+    echo "WARNING: fcntl.flock-based atomic writes are unreliable on network filesystems." >&2
+    echo "WARNING: Consider migrating to SQLite WAL for registry storage (see FUTURE_WORKS.md FW-02)." >&2
+  fi
+}
+
 atomic_dump_yaml() {
   local yaml_path="$1"; shift
+  _atomic_dump_yaml_check_nfs "$yaml_path"
   local -a envs=("YAML_PATH=$yaml_path" "HOME_DIR=$HOME_DIR" "CLAUDE_PROJECT_DIR=$CLAUDE_PROJECT_DIR" "LOCAL_BIN=$LOCAL_BIN")
   while [ $# -gt 0 ]; do
     case "$1" in