Fix lock file permissions for multi-user/container access

Lock files created by Docker containers (UID 2000) were not writable
by other users, causing 'Permission denied' errors when other jobs
tried to update the lock timestamp.

Add _touch_lock() helper that creates lock files with 666 permissions
and attempts to fix permissions on existing lock files.