How crowdsales typically work is that you have (at least) two different contracts: the actual token contract and the crowdsale contract. The crowdsale contract then has some sort of an access to the tokens which are used in the crowdsale - perhaps all the tokens are owned by the crowdsale contract initially.
But in general all the contract compositions are up to you to decide. You can write everything inside one contract or separate it in multiple contracts. It's mostly a matter of how easy it is to manage, deploy and maintain the separate contracts. Also, after the crowdsale, the crowdsale contract is no longer needed so it doesn't make much sense to still have the crowdsale code inside the token contract code.
As for your question about lock-time period, yes, you have to pay for gas if you issue a transaction to the contract. Typically the crowdsale contract owner issues a transaction which changes some state inside the contract and after that token owners can issue their transactions to claim the tokens. Or maybe the owner's transaction already assigns all the tokens.
As for the rest of your questions: as I said, you can develop the contracts as you want. If you want a private sale, only allow certain whitelisted addresses to participate. If you want to give out free tokens based on some conditions just write such functionality in the crowdsale. To deploy your contracts you can use for example geth - but there are plenty of alternatives out there.