Acquire the store lock in pin/profile commands before touching the store #102

pin add, profile create --from, profile apply, and profile delete all
create or reference store content or gc-roots without holding the
store lock that install/uninstall/generation commands already use. A
concurrent mere store clean's mark phase can miss a store path these
commands are about to reference (pin add's symlink, profile apply's
newly-installed packages before the profile root publishes) and delete
it out from under them.
Added src/cli/commands_test.zig as a new src/cli/-rooted test root
(sibling to command.zig, not under commands/) so commands/*.zig
handlers are unit-testable without hitting the existing
commands/-cannot-be-a-standalone-test-root wall: a file directly under
src/cli/ can import commands/*.zig fine, since their "../types.zig"
imports stay within src/cli/'s module root either way. Added a
regression test that pre-creates a valid, real store path (so
pin.create would legitimately succeed if reached) and blocks lock
acquisition by pre-creating mere/.lock as a directory; confirmed it
fails without the fix.