Make remote publish locks generation-safe

internal/stage/stage.go

@@ -33,6 +33,10 @@ type Env struct {
 	Scriptorium scriptorium.Runner
 	ObjectStore storage.ObjectStore
 	Notifier    notify.Sender
+
+	// RevalidatePublishLocks returns the effective lock set immediately before a
+	// publish commit selects a new remote snapshot.
+	RevalidatePublishLocks func(context.Context) ([]config.PublishLockRule, error)
 }
 
 // IODecl declares the intended input/output artifact kinds for a stage.