Mic_Class: serialize record() and lifecycle changes without blocking end()

[ainyan03]

Overview

Serializes Mic_Class::record() against concurrent callers and against lifecycle changes (begin()/end()), and makes begin()'s result honest on every board. Same family as the Speaker slot state-machine fix (#295), surfaced while auditing #348.

Problems in the current code

• Two concurrent record() callers can claim the same slot: their plain metadata writes race, and the capture task can pair one caller's buffer with the other's length.
• A record() racing end() can publish a request into a port that was just torn down, while still returning true.
• The default-rate record() overloads read _cfg.sample_rate outside any lock, and the capture task re-reads it after startup — a queued record() with a new rate could retune the clock under a request still being captured.
• On boards without a post-start callback, begin() did not verify that the capture task actually enabled the I2S channel, so an _i2s_start() failure left record() returning true for requests that could never complete.
• The stop handshake between end() and the capture task relied on volatile and on notifying a self-deleting task (racy against the TCB teardown; additionally, ESP-IDF 4.0–4.2 report an indefinite notification wait as eSuspended, so a scheduler-state check alone can act before the task's cleanup ran).

Design

• All request publishing happens under a dedicated _rec_lock; record(), end() and the public begin() all take _rec_lock before _begin_lock.
• The locks cover only bounded work (one begin + one claim attempt). When both slots are busy, or a rate change still has recordings draining, the caller releases the locks, waits outside them, and retries — end() never waits behind a full queue or a stalled capture.
• Requests carry a wrap-safe sequence number stamped under _rec_lock; the capture task consumes the pending slot with the older stamp. Slot identity cannot express publish order once a freed slot is refilled.
• The requested sample rate is validated and committed under _begin_lock (zero and overflow-prone values are rejected without poisoning the stored config), and the capture task uses the rate snapshot fixed before it was created.
• The capture task acknowledges its I2S cleanup through a dedicated atomic and parks itself with vTaskSuspend; _end_locked() deletes it only after the ack and the park. _task_running/_task_handle are atomics.
• begin() waits (bounded, 1 s) for the task to actually enable the channel on every board and fails cleanly otherwise; the raw rx_update latch wait is bounded and its timeout fails the begin.

Documented contracts (in the headers): the enable/post-start callbacks must not call begin()/end()/record(); config()/setSampleRate() (getters included) are stopped-port operations; the locks are per-instance, so two instances driving the same I2S port stay unsupported; the admission lock is an unfair CAS with no arrival order.

Verification

• Hardware stress on StopWatch (ESP32-S3): two tasks issuing back-to-back record() with varying lengths/rates plus a third task cycling end()/begin(), 10 minutes per iteration of this patch — no hang, no crash, no heap drift (~5,600 record iterations + ~500 end/begin cycles per run).
• Builds clean on the new I2S driver (ESP32-S3/IDF5), the legacy I2S driver (ESP32/IDF4-era core), and the native SDL port.
• The stock advanced/Mic_FFT example verified on the device.