fix(pi): serialize managed provider catalog writes

tests/unit/pi-provider-config.test.ts

@@ -194,6 +194,21 @@ describe('Pi Provider catalog', () => {
     expect(await readFile(filePath, 'utf8')).toBe('existing-catalog\n');
   });
 
+  it('serializes concurrent writes to the shared managed catalog', async () => {
+    const root = await mkdtemp(path.join(tmpdir(), 'makelore-pi-provider-concurrent-'));
+    temporaryRoots.push(root);
+    const filePath = path.join(root, 'models.json');
+    const catalog = buildPiProviderCatalog({ accounts: [account()] });
+
+    await Promise.all(Array.from({ length: 8 }, async () => await writePiProviderCatalog(
+      filePath,
+      catalog,
+      { accountId: 'account-one', modelId: 'gpt-5.4', thinkingLevel: 'off' },
+    )));
+
+    expect(JSON.parse(await readFile(filePath, 'utf8'))).toEqual(catalog.modelsFile);
+  });
+
   it('fails closed when a non-local credential is unavailable', async () => {
     const provider = account();
     const descriptor = buildPiProviderCatalog({ accounts: [provider] }).descriptors[0]!;