`cap-std` has no file locking; use `rustix::fs::flock` rather than the banned `std::fs::File::lock`

[leynos]

Observation

cap-std provides no file locking, and the obvious std::fs::File::lock
fallback is unavailable in chutoro-bench-datasets because Whitaker bans
std::fs there.

Evidence

cap-std 3.4.5 (the resolved version) exposes this complete public surface on
cap_std::fs::File (src/fs/file.rs): from_std, into_std, sync_all,
sync_data, set_len, metadata, try_clone, set_permissions,
open_ambient, create_ambient, open_ambient_with, options. There is no
lock and no try_lock.

The escape hatch into_std() returns a std::fs::File — precisely the type
banned in this crate, because chutoro_bench_datasets is not in the
excluded_crates list for no_std_fs_operations in the root dylint.toml
(the list is chutoro_benches, chutoro_test_support, kani_nightly_gate_cli,
benchmark_regression_gate_cli, kani_nightly_gate, benchmark_regression_gate,
chutoro_providers_dense, chutoro_cli).

So std::fs::File::lock (stabilised in Rust 1.89; the workspace
rust-version is exactly 1.89.0) is not reachable here.

Impact

Any design that assumed std::fs::File::lock for staging-file exclusion is
unimplementable as written. This was an explicit assumption in an earlier draft
of the 10.1.2 design and had to be corrected.

Resolution

Use rustix::fs::flock on the borrowed file descriptor obtained from
cap_std::fs::Dir / File via AsFd.

This adds no dependency. rustix 1.1.2 is already in Cargo.lock, reached
through cap-primitives 3.4.5 -> cap-std 3.4.5, and it provides exactly the
needed signature at rustix-1.1.2/src/fs/fd.rs:317:

pub fn flock<Fd: AsFd>(fd: Fd, operation: FlockOperation) -> io::Result<()>

Caveats to carry into the implementation:

• Use the non-blocking variant in a bounded loop with a hard timeout and a
  warn! on first contention. A lock with no timeout wedges every other job
  with no log line.
• flock is per-open-file-description, so it does not catch intra-process
  double-acquisition.
• Advisory locks are unreliable on NFS and overlay mounts. Document that the
  cache root must be a local filesystem.

Note cap-std is currently an optional dependency gated behind the testing
feature, so rustix presently arrives via the dev-dependency path. Promoting
cap-std to a real optional production dependency is part of roadmap 10.1.2.

References

• ExecPlan: https://github.com/leynos/chutoro/blob/10-1-2-shared-download-primitives/docs/execplans/10-1-2-shared-download-primitives.md
• Plan PR: Plan: Implement shared download primitives (10.1.2) #199
• Roadmap 10.1.2 (staging), 10.1.5 (cache lockfile semantics)