fix: add advisory file locking (flock) to prevent TOCTOU race in Installer::install() (closes #77)

[s2x]

Description

Closes #77

Adds advisory file locking (flock()) to Installer::install() to serialize concurrent installations of the FFI shared library, preventing a TOCTOU race condition between the file-exists check and the download+extract window.

Changes

• src/Installer.php: Acquire LOCK_EX on lib/install.lock before the file_exists check. Double-check inside the lock (re-verify library isn't already installed). Lock file persists as sentinel (never deleted) to ensure all processes share the same inode for flock() serialization. Lock released in finally — crash-safe.
• tests/test_installer_flock.phpt: 4 test scenarios — basic flock, concurrent serialization (3 child processes), source code pattern verification, and behavioral test calling Installer::install() with a dummy library.

Key Design Decisions

1. Lock file persists — never deleted (unlike previous temp-file cleanup patterns). Deleting the lock file would let a new process create a different inode and bypass flock() serialization entirely.
2. Lock-check pattern (not check-lock-check) — the pre-lock check is omitted for simplicity. In practice, install() is called at most once per Composer invoke, so the lock acquisition overhead is negligible.
3. Advisory locking — sufficient since all callers go through Installer::install().

Testing

• All installer tests pass (7/7)
• Behavioral test with actual Installer::install() call
• Concurrent serialization test with 3 child processes

Code Review

• Passed subagent code review
• All review comments addressed (lock file deletion bug fixed, PHPDoc clarified, test SKIPIF fixed, test behavior improved)