deploy consistent locking discipline.

[tychoish]

In reading through the agent code, it's not particularly straight forward (unless you read the comments) which locks you need to be holding to call a specific function. There are some changes to the concurrency model that we might want to deploy in the future (e.g. fewer locks, locks only protect fields in their own structs, etc,) but I think we shouldn't let the perfect be the enemy of the good, and in that spirit...

I would propose the following idiom:

No exported (public) function or method requires that the caller hold a specific lock and we should assume that they are safe to call from any go routine. Un-exported/private functions and methods should generally be responsible for holding/managing the scope of their locks (or not needing locks). If it's imperative that the caller of a private function hold a lock the word unsafe should appear in the function or method name.