make the publish lock keep the guarantee it claims

[thc1006]

Why

Four lock findings from the review of #81, and the half of a fifth that #83 left open.

The default fell back to tempfile.gettempdir(). That reads TMPDIR, which is the split namespace the fixed path was added to close. In a container with a read-only /tmp, two writers with different TMPDIR values took two lock files of the same name in two directories and both published — the original bug, reintroduced in the one place nobody would look for it.

A custom --lock-dir was taken on trust. O_NOFOLLOW stops a symlink planted at the path. It does not stop another uid unlinking the pathname between two writers' opens and creating its own file there; each then holds a different inode and flock excludes neither. On the default it is /tmp's sticky bit that prevents this.

The lock is named after the output path, which is container-local. One volume mounted at /data/out in one container and /mnt/out in another is two paths, so two locks, even with --lock-dir pointed at the volume.

The exclusion had only been measured between threads. Two threads of one interpreter with _default_lock_dir monkeypatched cannot see a TMPDIR difference at all, while the claim is about separate processes.

What

The default refuses instead of falling back, and says which flag settles it. A lock directory writable by other users has to carry the sticky bit; a private one is the ordinary case and needs nothing. --lock-key names the destination when the path cannot, and an empty key is refused because it would collapse every output directory sharing a lock directory onto one file.

There is a process-level exclusion case now: real subprocesses, different TMPDIR values, one shared --lock-dir, and the second gives up. It passed as written, so it documents a guarantee that already held rather than one that did not — which is the point of writing it down.

The ownership check also compares the raw mission id. The label is 64 bits of a digest and the raw id is already annotated beside it, so a collision could otherwise decide a delete on the digest alone. A caller holding no raw ids still reconciles by fingerprint rather than matching nothing.

Verification

Written as failing tests first, then each guarantee checked against a mutation: falling back to TMPDIR, trusting the lock directory, ignoring the key, accepting an empty one, dropping the raw-owner comparison, and making an absent owner set match nothing instead of everything. Each fails the test that names it.

The sticky-bit case is skipped when running as root, where the mode bits do not stop the write and the shape under test does not exist — skipped rather than asserted, which would pass for the wrong reason in a root container.

1011 pytest passed, 1 skipped. ruff clean, mypy clean, 15 goldens pass.

Depends on #83

Fourth in the stack: #81, #82, #83, then this.