ask: serialize concurrent CLI with repo lock and stale PID recovery

Add advisory lock under .git/hexai-ask.lock around Taskwarrior execution,
with metadata (PID and process basename) and Linux /proc comm checks to
remove orphan lock files when the recorded holder is gone or not ask.

Extract internal/filelock for shared flock helpers; stats uses it too.

Made-with: Cursor

1 files changed, 46 insertions, 0 deletions

diff --git a/internal/askcli/runlock_test.go b/internal/askcli/runlock_test.go
new file mode 100644
index 0000000..f56f214
--- /dev/null
+++ b/internal/askcli/runlock_test.go
@@ -0,0 +1,46 @@
+package askcli
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+func TestAcquireAskRepoLock_SerializesConcurrentHolders(t *testing.T) {
+	tmp := t.TempDir()
+	if err := os.MkdirAll(filepath.Join(tmp, ".git"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	var maxHeld int32
+	var cur int32
+	var wg sync.WaitGroup
+	for i := 0; i < 6; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			unlock, err := acquireAskRepoLock(context.Background(), tmp)
+			if err != nil {
+				t.Errorf("lock: %v", err)
+				return
+			}
+			defer func() { _ = unlock() }()
+			n := atomic.AddInt32(&cur, 1)
+			for {
+				old := atomic.LoadInt32(&maxHeld)
+				if n <= old || atomic.CompareAndSwapInt32(&maxHeld, old, n) {
+					break
+				}
+			}
+			time.Sleep(25 * time.Millisecond)
+			atomic.AddInt32(&cur, -1)
+		}()
+	}
+	wg.Wait()
+	if got := atomic.LoadInt32(&maxHeld); got != 1 {
+		t.Fatalf("max concurrent lock holders = %d, want 1", got)
+	}
+}