fix(storage): acquire lock in InMemoryBackend.get/get_last (#145)

[itsnevu]

Summary

InMemoryBackend.get() and get_last() read self._records without holding self._lock, unlike every other method on the backend (append, count, query, all_records, add_annotation, get_annotations). This is a TOCTOU race: get_last()'s if self._records / self._records[-1] can raise IndexError under a concurrent append(), and on non-CPython runtimes the read can observe a partially-initialized dict.

Change

Wrap both reads in with self._lock:, exactly as the issue's Expected behavior describes.

Testing

Added TestInMemoryBackend::test_get_and_get_last_hold_lock, which wraps the real lock and asserts both methods enter it. Fails on main, passes with the fix.

• Tests added/updated for the change
• ruff check src/ tests/ passes
• ruff format --check src/ tests/ passes
• mypy src/provena/ passes
• pytest passes with no failures
• CHANGELOG.md updated

Closes #145

[rajfirke]

Merged manually as commit c27e139 — CHANGELOG had a conflict after #154 landed first. The fix itself is identical to the PR. Thanks @itsnevu!