fix: Lock state and settings file updates

Constraint: rustup state and settings files can be touched by concurrent rustup processes.
Rejected: truncating on open | The exclusive lock must be held first.
Confidence: high
Scope-risk: narrow
Directive: Keep locked-file read/write changes focused on state/settings persistence semantics.
Tested: cargo test --features test locked_file_round_trip_truncates_previous_contents; cargo test --features test settings::tests; cargo test --features test --test test_bonanza notify_release_hint; cargo check --all-targets --features test; cargo clippy --all-targets --features test -- -D warnings; cargo fmt --all -- --check; git diff --check
Not-tested: full test_bonanza suite