Honor native file locks and serialize package publication

Two valid cached-package writers can both observe an absent native destination and then try to rename separate verified candidates into it. A real-filesystem regression produces DirNotEmpty for the losing publisher while its peer succeeds.

The first attempt to serialize publication also exposed a lower-level contract problem: the POSIX createFileAbsolute helper discards requested advisory locks and permission modes. Independent file tests show a requested 0600 file becoming 0644 and a second nonblocking exclusive opener succeeding while the first lock should be held.

Repair the owning native primitives, then serialize only the destination check, commit and rollback with a stable per-destination lock inode. Keep candidates private, preserve immutable shared sources, retain failed rollback backups, and preserve required setup failures. Do not unlink the coordination file while another writer may be waiting on its inode.

Verification must cover concurrent real filesystem publication, requested file permissions, nonblocking lock contention, the existing ownership/rollback/allocation regressions, a normal CLI build and installed native Git consumers. Publish through the normal patch release and consume that maintained release downstream.

Related: https://github.com/pantry-pm/pantry/issues/250, https://github.com/stacksjs/stacks/issues/3067 and https://github.com/stacksjs/hq.training/issues/318.

The exact path responsible for the Git CI PathAlreadyExists report in issue 250 remains unknown. This reproduced transaction race must not be presented as proof of that failed run's root cause.

Implemented and pushed in https://github.com/pantry-pm/pantry/commit/f98fa9a658bb86eb38c51b5894adc76fa70b1740. The normal bun run release:patch completed as v0.11.146 at 7e715cc; binary/package publication is running behind the normal exact-source CI gate.

Validation: pinned Zig 0.17.0, focused native materialization and file-primitive regressions pass (23 pass, one platform skip), Zig formatting passes, and the normal ReleaseFast CLI builds. Two independent real CLI processes concurrently installed the same pinned Git package into one fresh prefix; both exited zero. A subsequent cached reinstall exited zero, and its installed Git 2.53.0 ran successfully. The successful disposable prefix was removed after retaining the receipt and logs.

The earlier regression failed with a real DirNotEmpty at the competing publication boundary. Separate red tests showed ignored 0600 permissions (0644 observed) and ignored nonblocking exclusive locks before the primitive repair. No cache key, package provider, gate or retry budget was changed to obtain these results. The exact failed CI tree in /pantry-pm/pantry/issues/250 remains a separate open investigation.

Implemented in https://github.com/pantry-pm/pantry/commit/f98fa9a658bb86eb38c51b5894adc76fa70b1740 and published normally as v0.11.146, source https://github.com/pantry-pm/pantry/commit/7e715cc9aef13458a5113c09977f1f660d8ae182.

Verification:

• The real filesystem race failed before the fix; permission mode and nonblocking lock contention also failed against the old primitive.
• All 23 focused ownership/publication/rollback/primitive checks passed, with one platform-specific skip. Normal ReleaseFast CLI build passed.
• Full source CI, cross-platform/native verification, and the normal binary/npm publisher with archive verification passed.
• Installed the official published macOS binary through the official installer into an owned task directory. It reports pantry 0.11.146 (7e715cc9a). Two independent published CLI processes installed pinned Git 2.53.0 into the same fresh destination; both exited 0. A cached repeat exited 0 and the installed Git executable ran successfully. The disposable fixture was removed only after retaining its receipt.
• HQ's eight ReviewOS workflows consume the published action and native CLI at https://github.com/stacksjs/hq.training/commit/77d19afed. Stacks installed the published JS package normally and aligned its dependency floors, workflows and bootstrap at https://github.com/stacksjs/stacks/commit/aea3206c99. The next normal SDK release is separately tracked by /stacks/stacks/issues/3067.

This completes the reproduced publication/primitive issue. The exact failed CI path behind /pantry-pm/pantry/issues/250 remains unknown; that issue stays open. This does not claim a native LSU interaction pass or a successful newer HQ deployment.