Require flock for KWin setup and isolate authorization tests

[Staphylococcus]

Summary

KWin setup and removal use a nonblocking file lock, but flock was an implicit executable dependency. That also made the authorization fixture fail in pure build environments and obscured the first failure with a second panic during child cleanup.

• Install util-linux automatically when /usr/bin/flock is absent, verify the executable, and stop before installing LG Buddy if it cannot be provided.
• Report a clear dependency error from the KWin helper while preserving its setup lock. Keep its flock -n 9 call substitutable with a Nix store path.
• Keep authorization tests self-contained by taking the mock lock through Rust's libc::flock, and make child fixture cleanup safe on failure.
• Stabilize the parallel setup lock test and declare the dependency in CI and installation docs.

Scope

• This PR addresses one concern only.
• I split unrelated fixes, refactors, cleanup, or formatting into separate PRs.
• I read CONTRIBUTING.md and the relevant docs linked there.
• I discussed design-sensitive changes first, or this is a small obvious bug fix.

User-Visible Behavior

The installer treats flock as required for KWin setup. On apt, dnf, and pacman systems it installs util-linux without an optional-dependency prompt, verifies /usr/bin/flock, and stops before application installation if the dependency remains unavailable. Direct KWin setup reports a clear failure if flock is missing.

Validation

• RUST_TEST_THREADS=1 cargo test --locked --offline -p lg-buddy --quiet: passed (1,463 library tests, 1 ignored; 155 Cucumber scenarios; integration targets).
• All 19 authorization tests passed with a PATH containing no flock.
• Installer dependency smoke passed for apt, dnf, and pacman, including missing, failed, unsatisfied, and successful util-linux installation, plus an isolated PATH with the system executable present.
• The existing Nix package built from this PR's source; its installed helper references the util-linux store path and acquired its lock with flock absent from PATH.
• bash -n, scoped rustfmt --check, and git diff --check passed.
• An unrestricted parallel local run hit Text file busy in the unrelated GUI launcher test; the serial full run passed. The KWin shell smoke also fails at its existing provision assertion on this NixOS host in both the base and changed checkouts; the focused new lock diagnostic passed.

Related Issue

None.