fix(runtime): serialize deploys and clarify regional sources

deploy/unraid/deploy-release.sh

@@ -4,6 +4,17 @@ set -euo pipefail
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 cd "$ROOT"
 
+GEOINTEL_DEPLOY_LOCK_FILE="${GEOINTEL_DEPLOY_LOCK_FILE:-/tmp/geointel-release-deploy.lock}"
+if ! command -v flock >/dev/null 2>&1; then
+  echo "GeoIntel release deployment requires flock to prevent concurrent container replacement." >&2
+  exit 2
+fi
+exec 9>"$GEOINTEL_DEPLOY_LOCK_FILE"
+if ! flock -n 9; then
+  echo "Another GeoIntel release deployment is already running." >&2
+  exit 3
+fi
+
 if [ -f .env ]; then
   set -a
   # shellcheck disable=SC1091

deploy/unraid/run-dockerman-container.sh

@@ -4,6 +4,17 @@ set -euo pipefail
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 cd "$ROOT"
 
+GEOINTEL_CONTAINER_LOCK_FILE="${GEOINTEL_CONTAINER_LOCK_FILE:-/tmp/geointel-container-replacement.lock}"
+if ! command -v flock >/dev/null 2>&1; then
+  echo "GeoIntel container replacement requires flock to prevent concurrent Docker mutations." >&2
+  exit 2
+fi
+exec 8>"$GEOINTEL_CONTAINER_LOCK_FILE"
+if ! flock -w 300 8; then
+  echo "Timed out waiting for another GeoIntel container replacement to finish." >&2
+  exit 3
+fi
+
 if [ -f .env ]; then
   set -a
   # shellcheck disable=SC1091
@@ -188,7 +199,17 @@ install_dockerman_metadata
 docker compose down --remove-orphans || true
 
 if docker ps -a --format '{{.Names}}' | grep -qx geointel; then
-  docker rm -f geointel
+  docker rm -f geointel >/dev/null 2>&1 || true
+  for attempt in $(seq 1 60); do
+    if ! docker ps -a --format '{{.Names}}' | grep -qx geointel; then
+      break
+    fi
+    if [ "$attempt" -eq 60 ]; then
+      echo "GeoIntel container removal did not complete within 60 seconds." >&2
+      exit 1
+    fi
+    sleep 1
+  done
 fi
 
 mkdir -p "$GEOINTEL_STORAGE_PATH" "$GEOINTEL_MODELS_PATH" "$GEOINTEL_BACKUPS_PATH" "$GEOINTEL_POSTGIS_DATA_PATH"