This change narrows the lock scope for packaged preindexed source opens.

)

This change reduces the severe slowdown caused by recursive ACL
propagation on packaged temp paths while preserving the security
behavior that repairs improperly secured directories before use.

The fix keeps the existing fail-closed model, but avoids calling
`ApplyACL()` when the target directory is already in the exact secure
state winget expects.