scripts/opt-dgx-gate.sh says it runs the gate series under a flock and never takes one

Row: UPSTREAM-SYNC-HEADPIN

scripts/opt-dgx-gate.sh:4 says, in the script's own voice:

# Runs the whole gate series under ONE `flock ${GPU_LOCK:-$HOME/gpu.lock}` so the measurements are
# uncontended and a concurrent agent queues rather than interleaves;

It does not. flock appears exactly once in the file, on that comment line, and
never as a call:

$ grep -n flock scripts/opt-dgx-gate.sh
4:# Runs the whole gate series under ONE `flock ${GPU_LOCK:-$HOME/gpu.lock}` so the measurements are
$ grep -cE '^[^#]*\bflock\b' scripts/opt-dgx-gate.sh
0

The positive control is that other runners in the same directory do call it —
scripts/dspark-paired-e2e.sh, scripts/laguna_longctx_bench.sh and
scripts/dgx-gdn-packed-bridge-ab.sh all match ^[^#]*\bflock\b.

git log -S'flock' -- scripts/opt-dgx-gate.sh returns only aa65ce7b1, the
commit that created the file, so the call was never present and never removed;
the comment has been describing an invariant that has never held.

Why this matters rather than being a stale comment. This is the #777 family:
a mutex that is documented and not taken fails silently, because nothing reports
the absence and every run looks the same. #777 cost another session a full
standalone Marlin series, and 573716f332 — the commit that fixed it — touched
this very file without catching this line. An agent reading the header believes
the OPT gate series and its seven regression gates are serialised against a
concurrent agent. They are not, unless the caller happens to wrap the whole
invocation, which the Usage: line eleven lines below does not mention.

Two other scripts mention flock without calling it, and neither is this
bug. scripts/mxfp4-online-serving-grid.sh:15 states it as a precondition on
the caller's shell ("both flock locks free"), and
scripts/dgx-sglang-low-concurrency.sh:7 describes the campaign rather than the
script. Only opt-dgx-gate.sh asserts the action in its own voice.

The fix

Correct the header to say what the script does and who must hold the lock.
Do not add a flock call without deciding its relationship to the rc
lease first: AGENTS.md now makes the lease the required path to a fleet device
and says the file mutex runs inside a lease and never instead of one, so a
lock taken here needs to be the inner one, not a second truth. Two mutexes that
do not exclude each other are the failure this family is named for.

Why it is not fixed in the flow that found it

Found while specifying the token-exact gate at e126687a9a (#2794), which cites
this runner as the harness for our arm but does not invoke it. The repair
changes what a gate runner claims about contention, which is a decision about
the lease/mutex relationship rather than a typo, so it is listed under ## Owed
in .agents/specs/upstream-sync-headpin-tokengate.md rather than bundled into a
wave that measures something else.

Start with scripts/opt-dgx-gate.sh:4 and read AGENTS.md for the lease and mutex requirements. Check .agents/specs/upstream-sync-headpin-tokengate.md for the owed repair, then compare the other runners' flock usage. Done means the header accurately describes the caller's locking responsibility without claiming that this script takes the lock.