fix(runtime): serialize deploys and clarify regional sources

deploy/unraid/deploy-release.sh

@@ -4,6 +4,17 @@ set -euo pipefail
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 cd "$ROOT"
 
+GEOINTEL_DEPLOY_LOCK_FILE="${GEOINTEL_DEPLOY_LOCK_FILE:-/tmp/geointel-release-deploy.lock}"
+if ! command -v flock >/dev/null 2>&1; then
+  echo "GeoIntel release deployment requires flock to prevent concurrent container replacement." >&2
+  exit 2
+fi
+exec 9>"$GEOINTEL_DEPLOY_LOCK_FILE"
+if ! flock -n 9; then
+  echo "Another GeoIntel release deployment is already running." >&2
+  exit 3
+fi
+
 if [ -f .env ]; then
   set -a
   # shellcheck disable=SC1091