Commit challs.txt once a day at 04:00, separate from the HedgeDoc refresh

The 30-minute timer now only updates the HedgeDoc note; a new
ctf-challs.timer runs --challs daily at 04:00. Locks are per target so
the two runs can overlap without one skipping.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ctf_status.py

@@ -690,13 +690,14 @@ def push_hedgedoc(base: str, md: str) -> str:
     return loc if loc.startswith("http") else base.rstrip("/") + loc
 
 
-def single_run_lock():
-    """Keep a slow or hung cron run from colliding with the next one."""
-    fh = open(Path(tempfile.gettempdir()) / "ctf_status.lock", "w")
+def single_run_lock(target: str):
+    """Keep a slow or hung cron run from colliding with the next one. One lock per
+    target, so the daily challs.txt run and the HedgeDoc refresh can overlap."""
+    fh = open(Path(tempfile.gettempdir()) / f"ctf_status-{target}.lock", "w")
     try:
         fcntl.flock(fh, fcntl.LOCK_EX | fcntl.LOCK_NB)
     except OSError:
-        sys.exit("another ctf_status.py run is still going; skipping this one")
+        sys.exit(f"another ctf_status.py {target} run is still going; skipping this one")
     return fh  # held until the process exits
 
 
@@ -742,8 +743,9 @@ def main() -> None:
             sys.exit(str(e))
     if args.challs and not cfg.get("CHALLS_REPO_URL"):
         sys.exit("--challs needs CHALLS_REPO_URL in the config")
-    if note_url or args.challs:
-        lock = single_run_lock()  # noqa: F841  (held for the lifetime of the process)
+    # held for the lifetime of the process
+    locks = [single_run_lock(t) for t, on in (("hedgedoc", note_url), ("challs", args.challs))
+             if on]  # noqa: F841
 
     gl = GitLab(cfg["GITLAB_GROUP_URL"], cfg["GITLAB_TOKEN"])
     try: