Every repo's dev-release / beta-release workflow runs this script after its
build. Two merges landing in the same round (breadbar + breadbox this week)
run it concurrently on the one self-hosted runner, both writing
`${OUT}.tmp` in the shared output dir. The second `mv "${OUT}.tmp" "${OUT}"`
then fails "No such file or directory" — the first run already consumed it —
and `set -e` turns that into a red publish job, even though the index was
written correctly by the other run.
That's the whole reason breadbar's dev-release (run 126, the shell-theme
publish) showed red and the theme-capable binary looked unpublished.
- flock a per-track lock for the whole run, so the two invocations serialize
and the later one also sees the earlier's fresh `latest` symlink.
- mktemp -u the index.json / .minisig temp paths so even an unlocked caller
(INDEX_LOCK override, older workflow) can't collide.
Verified: two concurrent runs against a fake DL tree both exit 0 with one
consistent index.json and no leftover .tmp.
