Close TOCTOU between confirmation filter and consume (double-execution)

[ianpatrickhines]

Surfaced by independent review of PR #25 (#12). Non-blocking; filed as follow-up.

Problem

In nat_agent_streaming/handler.py, the confirmation check (filter_authorized_confirmations, a get_item) and the consume (consume_confirmation, a delete/update_item) are two separate DynamoDB operations with no transaction. Two concurrent invocations sharing a session could both pass the filter before either consumes, allowing one confirmed destructive action to execute twice.

Acceptance Criteria

• Consumption is atomic: consume_confirmation uses a ConditionExpression asserting the tool_id is still pending (e.g. contains(pending_tool_ids, :tid)), or filter+consume run in a DynamoDB transaction
• A simulated concurrent double-delivery executes the confirmed tool at most once
• Test covers the concurrent-consume case

Source: PR #25 review. Relates to epic #18.