fix(vendor): lock vendor cache/Hub during sync to prevent concurrent-run corruption

[HuangChenning]

Description

axon vendor sync reads/writes the shared vendor cache
(~/.axon/cache/vendors/<owner>/<repo>) and the Hub with no locking.
Two concurrent axon vendor sync runs race on the same git fetch/checkout and rsync -a --delete operations against the same
directories — reproduced directly (see #38): the losing process hits
rsync: [Receiver] getcwd(): No such file or directory (2) /
rsync error ... code 3 and/or git fetch failed ... exit status 128.

Changes

• Add vendor.AcquireSyncLock, a flock-based exclusive lock over the
  vendor cache root — same pattern already used for axon update
  (acquireUpdateLock in update.go)
• runVendorSync acquires the lock right after validating the config
  and before touching any vendor entry, and releases it via defer
  when the command returns
• Unlike the update lock, this does not retry/block — a full sync
  can take a while, so failing fast with an actionable message is more
  useful than waiting on an unknown-duration run

Type of Change

• Bug fix (non-breaking fix)

How to Test

Manually verified by launching two axon vendor sync processes at the
same time against the same axon.yaml:

• Before this fix: the losing process hit rsync getcwd()/exit-3
  errors and git fetch lock conflicts on several vendors
• After this fix: the losing process exits immediately with
  Error: another \axon vendor sync` is already running (lock: ...)`
  while the first process completes normally

Also added internal/vendor/lock_test.go:

• a second concurrent AcquireSyncLock call fails while the first
  lock is held
• re-acquiring after release() succeeds

Checklist

• Code follows style guidelines
• Self-review completed
• Tests added/updated

Related Issues

Closes #38