fix: satisfy the no-locked-pure-readers gate and close the DB before rmtree

_record_db_file_identity's PRAGMA fallback is a pure read — route it
through _read_ctx() instead of the writer lock (Pattern C gate).
test_codex_turn_persists_each_message_exactly_once leaked a live
SessionDB into shutil.rmtree, racing the WAL sidecars ('Directory not
empty' on CI); close the handle first and rmtree with ignore_errors.

hermes_state.py

@@ -5978,8 +5978,8 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
             self._db_file_application_id = disk_id
         elif self._conn is not None and not self._db_file_application_id:
             try:
-                with self._lock:
-                    pragma_row = self._conn.execute("PRAGMA application_id").fetchone()
+                with self._read_ctx() as conn:
+                    pragma_row = conn.execute("PRAGMA application_id").fetchone()
                 if pragma_row and pragma_row[0]:
                     self._db_file_application_id = int(pragma_row[0])
             except sqlite3.Error:

tests/agent/test_codex_app_server_persist.py

@@ -111,6 +111,7 @@ def test_codex_turn_persists_each_message_exactly_once():
     real AIAgent._flush_messages_to_session_db to prove no #860/#42039
     duplicate-write regression on the codex path."""
     tmp = tempfile.mkdtemp(prefix="codex_persist_")
+    db = None
     try:
         db = SessionDB(Path(tmp) / "state.db")
         sid = "sess-codex-once"
@@ -163,7 +164,9 @@ def test_codex_turn_persists_each_message_exactly_once():
     finally:
         import shutil
 
-        shutil.rmtree(tmp)
+        if db is not None:
+            db.close()
+        shutil.rmtree(tmp, ignore_errors=True)
 
 
 class TestGatewayPersistedResolution: