fix: assure refs are locked before reading them.

This was always the intend, but it was never implemented that way.
It's notable that on Windows special handling is needed to avoid
creating a lock file with names that can't be created, merely in
order to produce a better error message.