Recover orphaned trust locks safely

[solnikhil]

Summary

• make trust-store lock acquisition crash-safe and cross-platform
• publish complete owner metadata atomically, with POSIX identity claims and a serialized Windows recovery barrier
• recover dead, stale, malformed, or partially published lock state without deleting a live owner's lock
• reserve the pin transaction before invoking npm so concurrent installs cannot overwrite trust decisions
• add adversarial concurrency, process-death, malformed-state, and recovery tests

Verification

• 135 focused unit/security tests
• 246 exhaustive tests
• full GitHub Actions matrix passes on Windows, macOS, and Ubuntu

Closes #19

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 49a64ea2-423a-454c-b138-b65e74f3f0c8

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}