Add cross-platform file lock for concurrent venv installs (parity with JS bootstrap)

[ar7casper]

Context

When openant is invoked while another openant invocation is already running, two concurrent pip install -e <core> calls can race on the same ~/.openant/venv/. pip is not safe under concurrent installs to the same environment — typical failure modes include corrupted RECORD files, partial wheel extraction, and broken .dist-info metadata.

Two related code paths today have inconsistent treatment of this concurrency problem:

• JS parser bootstrap (fix: lazy-install JS parser npm deps on first use #37): implements a cross-platform file lock at parsers/javascript/.openant-npm-install.lock using msvcrt.locking on Windows and fcntl.flock elsewhere. Concurrent JS scans serialize cleanly.
• Go-side venv install (feat: auto-detect dependency changes and reinstall openant #36): documented as a "Known limitation" in apps/openant-cli/internal/python/runtime.go::CheckDepsStale. No lock. The stated rationale was that Go's stdlib doesn't have a portable flock equivalent on Windows.

The gap

For users with even simple parallel workflows (e.g. openant scan A & openant scan B, or two terminals doing openant parse <repo> simultaneously), the venv install path can race. JS bootstrap is safe; venv install is not.

Proposed approach

Add a Go-side file lock around the pip install -e call in CheckOpenantInstalled and CheckDepsStale. Two candidate implementations:

1. golang.org/x/sys/unix.Flock + golang.org/x/sys/windows.LockFileEx — direct OS calls, portable behind a build-tag wrapper.
2. github.com/gofrs/flock — third-party, cross-platform, ~200 LOC of dependency.

Option 1 aligns better with the "no extra dependencies" preference but requires platform-specific Go files. Option 2 is one import.

Lock target: ~/.openant/venv/.deps-install.lock. Same acquisition pattern as parsers/javascript/_file_lock (block-until-acquired, re-check sentinel inside lock).

References

• apps/openant-cli/internal/python/runtime.go — CheckDepsStale and CheckOpenantInstalled are the call sites needing the lock
• libs/openant-core/parsers/javascript/test_pipeline.py::_file_lock — reference impl
• feat: auto-detect dependency changes and reinstall openant #36 (deps-hash auto-reinstall) — established the codepath where the race lives
• fix: lazy-install JS parser npm deps on first use #37 (JS lazy install) — established the file-lock pattern for the analogous npm race