model download claims are per-workspace, so two workspaces sharing one model library can clobber each other

Start by reading _active_download_for and the claim-handling code in comfy_cli/command/models/models.py, alongside the claim helpers in comfy_cli/download_state.py. The issue calls for a design spike first: choose one of the three claim-store options and record the tradeoffs before implementation. Then use tests/comfy_cli/command/test_model_download_background.py to check the existing claim behavior; done means cross-workspace downloads to one destination refuse each other while preserving the listed cleanup, isolation, and in-workspace acceptance criteria.

What happens

comfy model download refuses a second download into a destination another download already
claimed. The claim is a lock file under <workspace>/.comfy-downloads/claims/, so the refusal only
works between invocations that resolve the same workspace.

Two invocations in different workspaces aimed at one file therefore consult disjoint claim
directories, see no competitor, and both proceed. On the httpx path each streams into its own
randomly-named .part sibling and the later rename silently overwrites the earlier; with
--downloader aria2 both write straight to the destination and interleave.

Why it matters more than it used to

Until #1094 this needed an explicit --relative-path escaping the workspace, so it was something a
user had to opt into. #1094 makes a typed download with no --relative-path save into the folder
the running local ComfyUI scans — which on Comfy Desktop is a shared library outside any workspace.
Two workspaces on one machine can now converge on the same absolute destination by default.

#1094 narrows the window (the server's folder is only adopted when it already exists locally, and an
explicit --workspace is never overridden) but does not close it, and says so.

Where it is already written down

_active_download_for's docstring in comfy_cli/command/models/models.py records the residual and
that closing it is an unmade design call:

A destination can sit outside the workspace … so two invocations run against different
workspaces but aimed at the same file consult disjoint <workspace>/.comfy-downloads directories
and are invisible to each other — both claim, both win, both write. Closing it needs a claim that
lives next to the destination rather than next to the workspace, or a refusal of
workspace-escaping --relative-path; both are design calls with their own tradeoffs and neither
is made here.

What a fix has to deal with

The claim key is already global — _dest_key is normcase(realpath(dest)) — so only the
directory holding the claim is workspace-scoped. That makes the change small in principle and not in
practice:

• _dest_claim_path resolves the claim under get_workspace(); download_state.claim_marker_for
  resolves the worker's from the state file's own parent, deliberately, because a worker is handed
  --state <file> and never re-resolves a workspace. A background worker has state.dest, so it
  can compute a destination-addressed claim — but both sides have to agree.
• _spawn_gap_holder resolves a claim's download_id through download_state.read(get_workspace(), id). Across workspaces that lookup fails, which currently reads as "stale, steal it". A held lock
  still refuses correctly; the spawn-gap judgment needs rethinking.
• A host-global store needs per-test isolation that does not exist: constants.DEFAULT_CONFIG is
  computed from ~ at import time and no fixture redirects it, so the suite would share one lock
  directory with the developer's machine.
• Roughly 45 cases in tests/comfy_cli/command/test_model_download_background.py address claims as
  download_state.claim_path(workspace, key), most with destinations outside their workspace.

Options, none chosen

1. Host-global claim store keyed by _dest_key, with a redirectable root for tests. Closes it
   for every destination, including the --relative-path case.
2. Destination-addressed claim, next to the destination. Naturally shared, but puts a dot-file
   inside a user's models folder — which _dest_claim_path's docstring explicitly rejected — and may
   not be writable.
3. Scope only the shared-library case, by recording on the download that its destination came
   from the server lookup and claiming those in a shared store. Narrowest, but adds a state field and
   leaves the --relative-path hole open.

Raised by CodeRabbit and the cursor-review panel on #1094
(https://github.com/Comfy-Org/comfy-cli/pull/1094#discussion_r4432563793,
https://github.com/Comfy-Org/comfy-cli/pull/1094#discussion_r4432602412) and deferred there rather
than fixed inside a destination-selection change.

Task Decomposition

Goal. Two comfy model download invocations in different workspaces aimed at the same absolute
destination refuse each other, exactly as two in one workspace already do.

Acceptance criteria.

• Two concurrent downloads from different workspaces to one destination: one wins, the other gets
  model_download_in_flight. True for foreground-vs-foreground, foreground-vs-background, and
  background-vs-background.
• A SIGKILLed holder still self-clears, and a dead holder's claim is stealable.
• No test writes a claim outside its own temporary tree.
• In-workspace behavior is unchanged: existing refusals, degradation to the advisory scan on a
  filesystem that cannot lock, and the owner-only mode on the claims directory.

Constraints. Must not change the destination-selection behavior added in #1094. Must not make a
download fail over bookkeeping — every degradation stays a warning plus the advisory scan.
DownloadState's on-disk shape is read by comfy model downloads / download-status, so a new
field needs a tolerant reader.

Existing context. comfy_cli/command/models/models.py (_dest_claim_path, _take_dest_claim,
_acquire_dest_claim, _spawn_gap_holder, _enforce_claim, _active_download_for),
comfy_cli/download_state.py (state_dir, claims_dir, claim_path, claim_marker_for,
lock_claim), tests/comfy_cli/command/test_model_download_background.py.

ID	Sub-task	Tier	Est	Depends	Acceptance
1	Spike: pick between the three options above and record the call in the issue. Decides whether a DownloadState field is needed at all.	deep	60m	—	One option chosen, in writing, with the rejected two and why
2	Add a redirectable root for host-global state (download_state.global_state_dir()), honoring an env override, owner-only, created lazily	routine	30m	1	Unit test: the override redirects it; the directory is 0o700
3	Autouse fixture redirecting that root per test, so no case can touch the real one	routine	30m	2	A test asserting the resolved root is under tmp_path; suite green
4	Move the claim path behind one resolver used by both the submitter and the worker (_dest_claim_path + claim_marker_for), so the two cannot disagree	analytical	60m	2	Existing claim tests pass against the resolver; one test asserts both callers resolve the same path for one dest
5	Fix holder resolution across workspaces: _spawn_gap_holder must not read an unresolvable id as "stale, steal it"	deep	60m	4	Test: a spawn-gap holder in another workspace is refused, not stolen
6	Cross-workspace refusal tests, all three kind-pairs, plus the SIGKILL self-clear case	analytical	60m	4,5	Red before 4, green after; no flake over 20 runs
7	Migrate the ~45 claim_path(workspace, key) call sites in the background test file	routine	30m	4	Full suite green on Linux, macOS, Windows
8	CHANGELOG entry naming the behavior change	trivial	5m	6	Entry under Fixed

No circular dependencies. Task 1 is a genuine spike and nothing after it should start before it
lands — options 2 and 3 above change which files move, so decomposing past it now would be guessing.