cmdPhaseComplete and cmdPhasesRemove read STATE.md outside the lock
then wrote inside. A crash between the ROADMAP update (locked) and
the STATE write left them inconsistent. Wrap both STATE.md updates in
readModifyWriteStateMd to hold the lock across read-modify-write.
Also exports readModifyWriteStateMd from state.cjs for cross-module use.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>