In the same manner as if invoked via SSH -- see the update_ref function in refs.c. The actual implementation of the locking mechanism lives in the lock_file function in lockfile.c, and yes, it creates a .lock file in there. Under the hood, it's done via the O_EXCL option to open().