chown only a lock file swarmctl just created and refuse a hard-linked one

swarm-authelia-bridge/README.md

@@ -56,9 +56,12 @@ What still has to hold, since two processes share the file:
   hold it until the rename lands, waiting at most 10 seconds. Reading the
   file first is not enough: both writers spend about a second minting a
   password between load and write, and the second rename would drop the
-  first writer's user. The lock file is opened `O_NOFOLLOW`, so neither side
-  can be pointed at another file through it. `swarmctl` is root and hands
-  the file it creates to the directory's owner, so the bridge can open it.
+  first writer's user. The lock file is opened `O_NOFOLLOW`, so a symlink
+  cannot point either side at another file. `swarmctl` is root: it refuses an
+  existing lock file with more than one hard link, and it changes the owner
+  of a lock file only when it created that file in the same call, handing it
+  to the directory's owner so the bridge can open it. The bridge opens the
+  lock read-only, which is all `flock` needs.
 - **Unknown keys survive.** Both carry unmodelled top-level and per-user
   fields through a round-trip, or whichever writes second would silently
   delete what the first added.