fix: make shiv install lock reentrant - #26

Summary

• make the serialized shiv package install lock reentrant for descendant nested shiv installs
• propagate an owner token plus MISE_JOBS=1 into the delegated shiv install command so package-local dependency installs can recurse without self-deadlocking
• add Lua regression coverage for owner propagation, matching-owner reentry, nested callback reentry, and the BackendInstall -> delegated install -> nested with_lock shape

Why

Fold CI and Brownie dispatch are blocked before tests/agent start on mise install with repeated nested failures like:

Timed out waiting for shiv package install lock at ~/.local/share/mise/shiv-backend/shiv.install.lock

Root cause: vfox-shiv serializes the delegated shiv install phase, but shiv install may run package-local mise install for dependencies. If those dependencies include shiv:* tools, the nested vfox-shiv invocation waits on the same lock held by its ancestor until timeout.

This keeps the lock for unrelated/concurrent top-level installs, while allowing descendants that inherit the matching owner token to reenter.

Validation

• mise run test lua
• mise run test bootstrap_dependencies
• isolated repro: current main + only shiv:emails@0.6.2 fails with the lock timeout; this branch linked as the shiv plugin succeeds with MISE_JOBS=1 and VFOX_SHIV_INSTALL_LOCK_MAX_ATTEMPTS=3
• git diff --check
• mise run test (82/82)
• self-review session: approved, with one low-severity advisory that the owner token is an advisory same-user mechanism rather than a security boundary; added an integration-style Lua regression after that review

Notes

VFOX_SHIV_INSTALL_LOCK_OWNER is not a security boundary. It is an advisory token to distinguish descendant nested installs from unrelated installs in the same mise data dir.