fix(compress): validate before locking, degrade lock on unsupported filesystems

Move the exists/size-cap/sensitive-path checks in compress_file() ahead of
file_lock() acquisition — none of them depend on mutual exclusion, and a
rejected input (bad path, oversized, sensitive name) was leaving a permanent
lock file behind in shared state.

fcntl.flock's POSIX branch had no errno classification: on filesystems that
don't implement byte-range locking (some NFS/SMB/FUSE mounts), the resulting
OSError propagated uncaught instead of the "silently degrades to a no-op"
behavior the PR body describes. file_lock now catches ENOLCK/EOPNOTSUPP/
ENOSYS specifically and proceeds unlocked with a warning, restoring pre-lock
behavior on those filesystems instead of making them a hard failure.

Also: lock_path itself is now refused if it's a symlink (mirrors the existing
lock_dir check, and is the only symlink guard Windows gets since O_NOFOLLOW is
POSIX-only), the locks directory is chmod 0700 (its filenames are unsalted
hashes of a guessable path), and LockTimeoutError now subclasses the stdlib
TimeoutError instead of a bespoke RuntimeError.