remove tar locking

Also moves the locker code back to `./lib/utils/locker.js` and makes it the only way it works.