fix(ci): publish under the lock Crafter.Review's workflow takes

Crafter.Review's workflow publishes its Flatpak into the same repo, the
web root's repo/, and holds an flock on .publish.lock in the web root
while it commits and updates the summary. Its comment says that this
protects both only once Crafter.Build's workflow takes the lock too, and
ours never did, so a publish of each could interleave: a
build-commit-from and a build-update-repo --generate-static-deltas
--prune of each workflow on one repo at the same time.

The Publish step now holds the same lock from its commit to the ref
files it writes into the web root, and the job installs util-linux for
flock, as Crafter.Review's jobs do.

AGENTS.template.md says that the repo is shared and the lock taken.
Neither it nor the workflow's header comment says any longer that the
web root and the signing key are this runner's alone, or that the
organisation-wide `flatpak` runner mounts none of them. That runner,
which serves every Catcrafts repository and refused all of this job's
volumes when it last took it, in October, now mounts the web root and
the key for Crafter.Review's publish job, and the volumes a runner
allows are open to every job it runs. The owner has ruled the sharing
intended. The header also stops saying that a job of ours that lands
there fails before building: that held while the runner refused every
volume, and AGENTS.template.md keeps it as the October history.

.forgejo/workflows/ci.yaml

@@ -11,9 +11,10 @@ name: Flatpak
 # flatpak-builder state (ccache and the LLVM module, so only crafter-build
 # itself rebuilds on a normal run), the published repo's web root, and the
 # repo signing key, which lives on the runner host and never in the forge.
-# No other runner carries that label. Plain `flatpak` also matches the
-# organisation's runner, which mounts none of those volumes; a job it picks
-# up fails before building anything.
+# No other runner carries that label. Plain `flatpak` is the label of the
+# organisation's runner, which serves every Catcrafts repository and also
+# mounts the web root and the key, for Crafter.Review's publish job, so any
+# job it runs can mount them (AGENTS.template.md, CI and publishing).
 on:
   pull_request:
     branches: [master]
@@ -45,11 +46,12 @@ jobs:
         -v /etc/crafter-flatpak:/run/crafter-flatpak:ro
     steps:
       - name: Install tools
+        # util-linux: flock, for the Publish step.
         run: |
           pacman-key --init
           pacman-key --populate archlinux
           pacman -Sy --noconfirm --needed archlinux-keyring
-          pacman -Syu --noconfirm --needed flatpak flatpak-builder ccache git nodejs jq gnupg go-yq ostree python
+          pacman -Syu --noconfirm --needed flatpak flatpak-builder ccache git nodejs jq gnupg go-yq ostree python util-linux
           git config --global --add safe.directory '*'
 
       - name: Sdk
@@ -144,6 +146,11 @@ jobs:
           export GNUPGHOME=$(mktemp -d)
           gpg --batch --quiet --import /run/crafter-flatpak/signing-key.asc
           FLATPAK_GPG_KEY_ID=$(cat /run/crafter-flatpak/key-id)
+          # Crafter.Review's workflow publishes into the same repo and holds
+          # this lock while it does, so a commit and the summary update of
+          # one workflow never interleave with the other's.
+          exec 9> "$WEB_DIR/.publish.lock"
+          flock 9
           # The live repo is the canonical copy; builds are promoted into it,
           # never built into it.
           # Keyed on the repo's config file, not the directory: the web root
@@ -158,6 +165,7 @@ jobs:
           key=$(gpg --export "$FLATPAK_GPG_KEY_ID" | base64 --wrap=0)
           sed "s|GPGKey=.*|GPGKey=$key|" packaging/flatpak/catcrafts.flatpakrepo > "$WEB_DIR/catcrafts.flatpakrepo"
           sed "s|GPGKey=.*|GPGKey=$key|" packaging/flatpak/net.catcrafts.CrafterBuild.flatpakref > "$WEB_DIR/net.catcrafts.CrafterBuild.flatpakref"
+          flock -u 9
           # The release attaches this .flatpakref, not the one in the
           # checkout: that one has a placeholder where the key goes, and
           # flatpak cannot install from it.