fix(windows): lock claim validation boundary

tools/tht/internal/safeio/claim_windows.go

@@ -14,6 +14,11 @@ import (
 // another's bounded external-contention retry while its validated parent handle is retained.
 var windowsPrivateClaimOperationMu sync.Mutex
 
+func lockCanonicalPrivateClaimOperation() func() {
+	windowsPrivateClaimOperationMu.Lock()
+	return windowsPrivateClaimOperationMu.Unlock
+}
+
 type windowsPrivateRegular struct {
 	parents *windowsParentHandles
 	handle  windows.Handle
@@ -54,8 +59,6 @@ func openWindowsPrivateRegular(path string, links uint32) (*windowsPrivateRegula
 }
 
 func claimCanonicalPrivateRegular(source, claim string) (claimed bool, resultErr error) {
-	windowsPrivateClaimOperationMu.Lock()
-	defer windowsPrivateClaimOperationMu.Unlock()
 	directory, sourceName, claimName, err := openWindowsPrivateClaimDirectory(source, claim)
 	if err != nil {
 		return false, ErrUnsafeFile
@@ -70,8 +73,6 @@ func claimCanonicalPrivateRegular(source, claim string) (claimed bool, resultErr
 }
 
 func readCanonicalPrivateClaim(source, claim string, maximum int64) (contents []byte, found bool, resultErr error) {
-	windowsPrivateClaimOperationMu.Lock()
-	defer windowsPrivateClaimOperationMu.Unlock()
 	directory, sourceName, claimName, err := openWindowsPrivateClaimDirectory(source, claim)
 	if err != nil {
 		return nil, false, ErrUnsafeFile
@@ -104,8 +105,6 @@ func openWindowsPrivateClaimDirectory(source, claim string) (PrivateDirectoryHan
 }
 
 func removeCanonicalPrivateClaim(source, claim string) (removed bool, resultErr error) {
-	windowsPrivateClaimOperationMu.Lock()
-	defer windowsPrivateClaimOperationMu.Unlock()
 	directory, sourceName, claimName, err := openWindowsPrivateClaimDirectory(source, claim)
 	if err != nil {
 		return false, ErrUnsafeFile