I don't normally stop and think about security, but in the above I should have. KM already pointed out why using touch was bad. But apparently nobody noticed that I was opening and truncating files without testing whether they were not symlinks.

Oops.

I am posting a new node here describing the problem so that if anyone is using it and the oversight matters, they can know to change it. The two edits will be to create the lockfile if need be with append instead of overwrite, and to test the file I open for being a symlink.