fix(windows): lock claim validation boundary

tools/tht/internal/safeio/files.go

@@ -354,6 +354,8 @@ func RemoveCanonicalPrivateRegular(path string) error {
 // ClaimCanonicalPrivateRegular atomically creates a second, explicit private hard link to one
 // existing record. It is used only for digest-named, single-use OIDC state claims.
 func ClaimCanonicalPrivateRegular(source, claim string) (bool, error) {
+	unlock := lockCanonicalPrivateClaimOperation()
+	defer unlock()
 	if err := validateClaimPaths(source, claim); err != nil {
 		return false, ErrUnsafeFile
 	}
@@ -363,6 +365,8 @@ func ClaimCanonicalPrivateRegular(source, claim string) (bool, error) {
 // ReadCanonicalPrivateClaim reads a verified two-link source/claim pair. found=false means the
 // state has already been consumed or a winning process is between its two removal steps.
 func ReadCanonicalPrivateClaim(source, claim string, maximum int64) ([]byte, bool, error) {
+	unlock := lockCanonicalPrivateClaimOperation()
+	defer unlock()
 	if maximum < 0 || maximum == int64(^uint64(0)>>1) || validateClaimPaths(source, claim) != nil {
 		return nil, false, ErrUnsafeFile
 	}
@@ -371,6 +375,8 @@ func ReadCanonicalPrivateClaim(source, claim string, maximum int64) ([]byte, boo
 
 // RemoveCanonicalPrivateClaim removes exactly a verified two-link source/claim pair.
 func RemoveCanonicalPrivateClaim(source, claim string) (bool, error) {
+	unlock := lockCanonicalPrivateClaimOperation()
+	defer unlock()
 	if err := validateClaimPaths(source, claim); err != nil {
 		return false, ErrUnsafeFile
 	}