I don't normally stop and think about security, but in the
above I should have.
KM already pointed out why using
touch was bad. But apparently nobody noticed that I was
opening and truncating files without testing whether they
were not symlinks.
Oops.
I am posting a new node here describing the problem so that
if anyone is using it and the oversight matters, they can
know to change it. The two edits will be to create the
lockfile if need be with append instead of overwrite, and
to test the file I open for being a symlink.