shuriken: flock mutex so generation and sync never overlap

The generation and sync CronJobs are separate, so each one's
concurrencyPolicy:Forbid only blocks itself, not the other. Add a
shared flock on /data/shuriken.sh/.lock (the NFS volume, auto-released
on pod death so a crash never leaves a stale lock):

- generation: blocking-acquire the lock around the whole multi-site
  entrypoint run (waits for any in-progress sync, which is short).
- sync: non-blocking acquire; skip the tick if generation holds it.

flock is already in the image (util-linux), so no rebuild needed.

0 files changed, 0 insertions, 0 deletions