Singleton lock: refuse to start when another rtime is running

[mack42]

Defense in depth — even with the AiFw rc.d fix, the binary should refuse a second invocation if launched manually.

Fix: add a local single_instance module (fcntl F_SETLK F_WRLCK on /var/run/rtime.lock) and call acquire("rtime") at the top of main.

Tracking spec (in AiFw repo): docs/superpowers/specs/2026-04-26-process-hardening-and-ids-extraction-design.md

Acceptance: second invocation prints rtime: another instance is already running (pid X) and exits 1.