Fix critical lock-expiry window found in Codex second pass

- poller.py: start lock_refresher() IMMEDIATELY after acquiring the lock,
  before the startup jitter and restart-storm deferral. Those sleeps can
  together exceed LOCK_TTL (restart defer is up to POLL_SWEEP_INTERVAL), so
  with the refresher started afterward the lock could expire mid-deferral and
  a second poller could begin sweeping concurrently — the exact hardware-storm
  risk this design prevents.
- hwgate.py: clamp POLL_CONCURRENCY to 1 unless POLL_ALLOW_UNSAFE_CONCURRENCY
  is set (fragile SAS hardware; >1 can drop expanders). Warn either way.
- build.sh: keep backward-compatible — a non-target first arg is treated as
  the commit message (./build.sh "msg" still works), known targets select
  web|poller|all.

build.sh

@@ -13,14 +13,15 @@ REG="docker.adamksmith.xyz"
 
 cd "$(dirname "$0")"
 
-TARGET="${1:-all}"
-case "$TARGET" in
-    poller) TARGETS="poller" ;;
-    web)    TARGETS="web" ;;
-    all)    TARGETS="poller web" ;;
-    *) echo "usage: $0 [poller|web|all] [message]" >&2; exit 1 ;;
+# First arg is the target if it's a known one; otherwise it's treated as the
+# commit message (backward-compatible with `./build.sh "message"`).
+case "${1:-}" in
+    poller) TARGETS="poller"; MSG="${2:-Build and push images}" ;;
+    web)    TARGETS="web";    MSG="${2:-Build and push images}" ;;
+    all|"") TARGETS="poller web"; MSG="${2:-Build and push images}" ;;
+    *)      TARGETS="poller web"; MSG="${1}" ;;
 esac
-MSG="${2:-Build and push images}"
+TARGET="${TARGETS// /+}"
 
 # Stage and commit all changes
 git add -A