Sibling lock file that serializes token refreshes across processes.
A dedicated .lock file (never the token file itself) lets filelock
coordinate refreshes between dcode processes and provider instances
without ever holding an exclusive lock on the credential file. It holds
no token material.
