use locks via LockFile objects from cache.lock()

Fixes lock ownership issues under heavy contention. Also locks the tarball in unpack().