fix(server-s3): transcript snapshot copies asynchronously (F42 follow-up)

copyIfNewer read/wrote a member file of up to 256 MiB with readSync/writeSync,
blocking the event loop for every user. It now copies with fs.promises 1 MiB
at a time from the runAs.openSafeAsync handle (owner/type check kept), keeps
the 256 MiB member cap and zero-run holes, writes a temp file and renames it
into place, and joins a copy already in flight for the same destination.
A failed copy is logged and never rejects; snapshotTranscript is async and
all three import callers await it.

server/__tests__/server-s3-review3.test.js

@@ -229,7 +229,7 @@ describe("a member's planted link is never followed with the dashboard's rights"
     fs.mkdirSync(path.join(proj, sid, "subagents"), { recursive: true });
     fs.writeFileSync(path.join(proj, `${sid}.jsonl`), '{"own":1}\n');
     fs.writeFileSync(path.join(proj, sid, "subagents", "agent-own.jsonl"), '{"own":2}\n');
-    snapshotTranscript(path.join(proj, `${sid}.jsonl`), sid);
+    await snapshotTranscript(path.join(proj, `${sid}.jsonl`), sid);
     const snap = getTranscriptSnapshotDir();
     assert.equal(fs.readFileSync(path.join(snap, `${sid}.jsonl`), "utf8"), '{"own":1}\n');
     assert.ok(fs.existsSync(path.join(snap, sid, "subagents", "agent-own.jsonl")));