fix: harden posix conditional publish locking

Fail closed on unexpected advisory-lock errors instead of silently reducing
cross-process exclusion to a local mutex. Make local publish-slot waits honor
request cancellation. Move version snapshots under the publish lock so
concurrent versioned PUTs preserve publication order. Add regression coverage
for canceled lock waiters.

Also add an option to disable flock files and only rely on in process locking.

cmd/internal/gwcli/posix.go

@@ -39,6 +39,7 @@ var (
 	nometa               bool
 	forceNoTmpFile       bool
 	forceNoCopyFileRange bool
+	forceNoObjLockFile   bool
 	enableODirect        bool
 	actionsConcurrency   int
 	ioBufferSize         int
@@ -142,6 +143,12 @@ will be translated into the file /mnt/fs/gwroot/mybucket/a/b/c/myobject`,
 				EnvVars:     []string{"VGW_DISABLE_COPY_FILE_RANGE"},
 				Destination: &forceNoCopyFileRange,
 			},
+			&cli.BoolFlag{
+				Name:        "disable-object-lock-file",
+				Usage:       "disable shared advisory lock files for conditional object publishes (unsafe with multiple gateway processes)",
+				EnvVars:     []string{"VGW_DISABLE_OBJECT_LOCK_FILE"},
+				Destination: &forceNoObjLockFile,
+			},
 			&cli.BoolFlag{
 				Name:        "enable-odirect",
 				Usage:       "enable best-effort O_DIRECT for object data reads/writes",
@@ -194,6 +201,7 @@ func runPosix(ctx *cli.Context) error {
 		VersioningDir:        versioningDir,
 		ForceNoTmpFile:       forceNoTmpFile,
 		ForceNoCopyFileRange: forceNoCopyFileRange,
+		ForceNoObjLockFile:   forceNoObjLockFile,
 		EnableODirect:        enableODirect,
 		ValidateBucketNames:  DisableStrictBucketNames,
 		Concurrency:          actionsConcurrency,

cmd/versitygw/main.go

@@ -123,9 +123,16 @@ func main() {
 	gwcli.RunIAM = runIAM
 
 	app := initApp()
+	posixCommand := gwcli.PosixCommand()
+	posixCommand.Before = func(ctx *cli.Context) error {
+		if ctx.Bool("disable-object-lock-file") {
+			fmt.Println("Warning: shared object publish locking disabled; conditional write atomicity is limited to this gateway process")
+		}
+		return nil
+	}
 
 	app.Commands = []*cli.Command{
-		gwcli.PosixCommand(),
+		posixCommand,
 		gwcli.ScoutfsCommand(),
 		gwcli.S3Command(),
 		gwcli.AzureCommand(),