ship-queue: train land should take the shared land lock (refs/notes/gstack-land) #3599

Found by the Codex outside voice on #3595 (GSTA-154 PR B), deferred with the trail's reasoning.

gstack-ship-queue train land does not take the land lock (refs/notes/gstack-land) that gstack-ship-queue land takes. Two controllers, or a train controller running at the same time as a standalone land, can both read the same base and pass the final main check. --match-head-commit protects only the PR head, so if their release-file patches merge cleanly, main can end up with a combined tree that neither gate tested. The freeze fires only after that tree is published.

Why it was deferred: CREW.md rule 6 makes one controller (GStack Minder) the only merger, so the race needs two concurrent mergers. Train land re-reads main right before gh pr merge, and any other main afterwards freezes the queue.

Fix: train land acquires and releases the same lock around its stamp → push → merge phases (or shares land's setLock), and standalone land refuses while a train slot holds it. Test: a held land lock makes train land refuse with QUEUE_LAND_LOCKED, and the reverse.