Make sure we keep the packfile locked until we've updated the tips

This is mostly as a reminder to myself to do this at some point, but if someone feels like it, they're welcome to take this on.

There is some amount of time between the rename of the packfile to its final name and the update of the remote-tracking branches. If a gc process runs between those two operations, it may see that our brand new packfile contains only unreferenced objects, so it might decide to delete it. This would make our ref updates quite unhappy (not to mention the user).

What git does is lock the packfile (via a .keep file, which tells a gc process not to touch it) between those times and then remove the keep-file after the refs have been updated and we now have made our objects reachable.

Start by tracing the packfile rename and remote-tracking branch update described in the issue, and inspect how the existing code handles .keep files during that interval. Done means the packfile remains protected from gc until the refs are updated, then the keep-file is removed; the issue names no specific files or tests.