fix(credentials): use wx exclusive create for lock acquisition

renameSync atomically replaces an existing lock file on POSIX, so two
contending processes can overwrite lockPath and both enter the critical
section. writeFileSync with flag 'wx' creates the lock with full PID and
timestamp content in one syscall, preserving mutual exclusion without the
open-then-write TOCTOU window.

Author: SahilRakhaiya05

src/lib/credentials.ts

@@ -220,17 +220,10 @@ function acquireCredentialsLock(credentialsPath: string): void {
   mkdirSync(dirname(lockPath), { recursive: true, mode: 0o700 });
   const deadline = Date.now() + CREDENTIALS_LOCK_MAX_WAIT_MS;
   while (Date.now() < deadline) {
-    const tmp = `${lockPath}.tmp.${process.pid}.${Date.now()}`;
-    writeFileSync(tmp, `${process.pid}\n${Date.now()}\n`, 'utf8');
     try {
-      renameSync(tmp, lockPath);
+      writeFileSync(lockPath, `${process.pid}\n${Date.now()}\n`, { flag: 'wx', encoding: 'utf8' });
       return;
     } catch (err) {
-      try {
-        unlinkSync(tmp);
-      } catch {
-        // Best-effort cleanup of the unclaimed temp file.
-      }
       const code = (err as NodeJS.ErrnoException).code;
       if (code !== 'EEXIST') throw err;
       if (isStaleCredentialsLock(lockPath)) {