Sync stat and unlock in lock()

This fixes an issue in npm where tons of packages were trying to install a particular dependency. It removes a race condition in lock() that would remove the underlying lock based on stale stat() information.