Make the process-wide lock atomic with flock (closes #227)

Acquire read vaultik.pid, checked whether that PID was alive, then
wrote its own, so two writers started together could both pass the
check and both run. The lock is now an flock on vaultik.pid, held
while the file stays open; the kernel drops it when the process exits,
so the stale-PID check is gone.

Release empties the file instead of deleting it. Deleting it would let
a process that opened the old file a moment earlier lock it while
another creates and locks a new one.

The new concurrent test fails against the old code only when the race
is hit, not on every run; against the fix it cannot admit two callers.

Model: opus-5-5

TODO.md

@@ -22,6 +22,16 @@ the tag exists and is exercised; what is left is merging `next` to
 
 # Completed Steps
 
+- 2026-10-07: Made taking the process-wide lock atomic
+  ([issue #227](https://git.eeqj.de/sneak/vaultik/issues/227)). The lock
+  read `vaultik.pid`, checked whether that PID was alive and then wrote
+  its own, so two writers started together could both pass the check and
+  both run. It is now an `flock` on `vaultik.pid`, held until the run
+  ends; the kernel drops it when the process exits, so a crash leaves no
+  lock behind. A clean exit now empties the file instead of deleting it,
+  because deleting it would let two later runs each lock a different
+  file.
+
 - 2026-10-06: Made `snapshot remove --json` write only its document to
   stdout when the destination store cannot be reached
   ([issue #251](https://git.eeqj.de/sneak/vaultik/issues/251)). Its