fix(controller): give each SmoothingController its own EMA state - #297

Fixes #296.

What was wrong

SmoothingController kept its EMA state in the per-trial store under a single
module-level key (controller.py:69), read and written destructively
(controller.py:93-95). Two instances active in the same trial therefore shared
one slot: each layer smoothed against whatever the other last wrote, so both
emitted something that is neither layer's intended output — silently, with no
crash or warning.

The class docstring presents this exact composition as the point of the design
("Demonstrates the middleware composition the single-method interface enables"),
and nothing warns against stacking two.

Stacking alpha=0.9 over alpha=0.5 on the stream [1, 5, 2, 8, 3]:

shared store (actual)  : [1.0, 3.0, 2.5,   5.25,  4.125]
independent (expected) : [1.0, 2.8, 2.53,  4.978, 4.2103]
keys in store: ['_smoothing_prev_action']

One key for two controllers, diverging from the second step on.

The fix

Namespace the key per instance via a module-local serial. The contrast that makes
this the right shape: _INFER_KEY is safe to share because it is only ever
appended to (controller.py:65, controller.py:159), so DefaultController
and EnsemblingController coexisting merely add entries. _SMOOTH_KEY was the
only destructively written controller state, which is exactly why sharing it broke.

I used a counter rather than id(self) so the key is deterministic and readable in
a dumped store.

Tests

test_stacked_smoothing_controllers_keep_separate_state stacks two layers and
compares against the independently computed nested EMA. Against unfixed code:

assert np.allclose([1.0, 3.0, 2.5, 5.25, 4.125],
                   [1.0, 2.8000000000000003, 2.5300000000000002, 4.978000000000001, 4.2103])
E   assert False

Worth noting explicitly: my first attempt at this test passed against the broken
code, because I drove it with ScriptedPolicy, whose oracle emits near-constant
steps — with a constant stream the corruption is invisible. The test needs a
varying action stream, which is why it uses a small local stub policy. I mention it
because it is the kind of regression test that would otherwise look fine and assert
nothing.

Verification

pytest --cov   1137 passed, 5 skipped   Total coverage: 100.00%
ruff format    127 files already formatted
mypy           Success: no issues found in 74 source files
ruff check     2 errors, both pre-existing in plugins/inspect-robots-agent
               (policy.py:283,288 union order) and untouched here

CHANGELOG conflict, deliberately

The ### Fixed insertion points are all currently claimed by open PRs, so this
entry shares an anchor with my #290 — those two conflict in CHANGELOG.md and
nothing else. I first placed it where it collided with #251, which is approved
and waiting, and moved it specifically so the collision lands on my own newer PR
instead. Verified clean against #250, #251, #256, #286, #288, #293, #295.

Merge #290 or this in any order and I'll rebase the other immediately.

What I deliberately left out

• No refusal to nest. Making SmoothingController reject an inner
  SmoothingController would also close the bug and is a smaller behavioural
  surface; I went with isolating state because the docstring advertises
  composition. If you'd rather it refuse, say so and I'll swap it.
• No change to _INFER_KEY or _BUFFER_KEY. They are shared safely for the
  reason above, and touching them would be scope creep.
• On reachability, plainly: stacking two smoothers is unusual, and I found this
  by reading for state-isolation bugs, not from a failing run. It is latent. I
  think it earns a fix because it is silent and produces wrong actuation, but it is
  not urgent, and I would understand closing it as won't-fix.