Freeze the Go implementation as a test-only oracle, with vectors

oracle/go is the Go code at 4c1507c, moved unchanged, plus test-only
generators that record what it computes. tests/vectors holds the
deterministic crypto/store vectors and synthetic fixtures they produce.

Co-Authored-By: Claude <noreply@anthropic.com>

oracle/go/lock.go

@@ -0,0 +1,28 @@
+// Copyright 2026 The vault Authors.
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package main
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+)
+
+const lockName = ".lock"
+
+// lockVault takes the vault lock: exclusive for commands that change the
+// vault, shared for commands that only read it. If another vault process
+// holds a conflicting lock it says so and waits. The returned function
+// releases the lock.
+func lockVault(root string, exclusive bool) (func(), error) {
+	release, err := acquireLock(filepath.Join(root, lockName), exclusive, func() {
+		fmt.Fprintln(os.Stderr, "waiting for another vault process to finish")
+	})
+	if err != nil && !exclusive {
+		// A reader on read-only storage cannot create the lock file, and
+		// nothing can be writing there either.
+		return func() {}, nil
+	}
+	return release, err
+}