move locks back into cache, now path-aware

Since there may be multiple locks for a given packages (in different
places), flip the order to make it clearer to debuggers where the lock
came from.  Also wrote a very basic test of locker just so we notice if
it spontaneously breaks.