Lock the state directory and write vault files atomically (closes #34)

Each command that changes the state directory holds one lock: flock(2)
on `lock` in the state directory, dropped by the kernel if the process
dies, or a process-wide mutex on the in-memory test filesystem. It
covers the state directory, not each vault, because `currentvault`,
`vault create` and cross-vault moves span vaults, and a lock file in a
vault would be deleted by `vault remove` under a waiting command.
Serializing changes across vaults costs a command-line tool nothing.

Files go through `secret.WriteFileAtomic`; versions, new secrets and
cross-vault copies are built in a temporary directory and renamed into
place; removals rename out of the way first.

Model: opus-5-5

internal/vault/lock.go

@@ -23,7 +23,8 @@ var memFsLock sync.Mutex
 // LockStateDir takes the lock that a command changing anything under
 // stateDir holds until it returns, and returns the function that releases
 // it. While one command holds it, the next one waits here. Reads take no
-// lock: every change becomes visible in a single rename.
+// lock: each file or directory a command changes is replaced in a single
+// rename, so a reader finds it as it was before or after, never half-made.
 //
 // On the real filesystem the lock is flock(2) on the file "lock" in
 // stateDir, which the kernel releases when the process dies, so a killed