Issue Description:

We should add a "lock" used by the package manager when mutations to the workspace are being made by the package manager – i.e. if a user happens to run two package manager operations that mutate the package at the same time, they should be serialized.

We can do this by using the standard UNIX file locking facilities (and things like writing the PID into the lockfile so that we be resilient to situations where we crashed with the lock held).