promote-latest.sh: serialize concurrent runs (no lockfile) #372

Follow-up from #366 (the latest promote tool).

scripts/promote-latest.sh takes no lock. Two runs against the same repo and registry at
once can interleave their npm dist-tag add calls, and a rollback in one run can undo the
other's good promote. Nothing prevents a second operator — or a re-run — from starting while
a first run is mid-loop.

Add a lockfile (repo-local) acquired before the first move and released on exit, including
via the existing INT/TERM/HUP traps, refusing with a clear message if it is already held.

Refs #366