Add vault locking and a cross-platform build script

Commands that change the vault hold an exclusive lock on DIR/.lock and
readers hold a shared one, taken after the passphrase prompt. A blocked
process says it is waiting. Unix uses fcntl locks and Windows uses
LockFileEx, both released by the OS if the process dies. Plan 9 and
WebAssembly fall back to an exclusive lock file.

build.sh cross-compiles static binaries for every Go target that builds
without cgo (43 today, armv6 and armv7 for 32-bit ARM Linux) and writes
SHA256SUMS.

lock.go

@@ -0,0 +1,28 @@
+// Copyright 2026 The vault Authors.
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package main
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+)
+
+const lockName = ".lock"
+
+// lockVault takes the vault lock: exclusive for commands that change the
+// vault, shared for commands that only read it. If another vault process
+// holds a conflicting lock it says so and waits. The returned function
+// releases the lock.
+func lockVault(root string, exclusive bool) (func(), error) {
+	release, err := acquireLock(filepath.Join(root, lockName), exclusive, func() {
+		fmt.Fprintln(os.Stderr, "waiting for another vault process to finish")
+	})
+	if err != nil && !exclusive {
+		// A reader on read-only storage cannot create the lock file, and
+		// nothing can be writing there either.
+		return func() {}, nil
+	}
+	return release, err
+}