Warning: This build has drifted.
The coverage report for this pull request build may be inaccurate because its base commit is no longer the HEAD of its target branch.
This means it includes changes from outside the original pull request, including, potentially, unrelated coverage changes.

    • Learn more: For more information on this, see Tracking coverage changes for pull request builds.
    • Fix now: For a quick fix, rebase this PR at GitHub. Your next report should be accurate.
    • Prevent going forward: To avoid this issue with future PRs, see these Recommended CI Configurations.

refactor: replace cruid sync.Map with volumeLocks for kerberos symlink protection

Use the existing d.volumeLocks.TryAcquire/Release mechanism instead of a
package-level sync.Map to serialize symlink operations per cruid. Also
convert ensureKerberosCache to a driver method and simplify with early return.