A concurrent install can temporarily remove or invalidate package metadata. Wait on the shared installation lock before the initial update-mode read, then release it before network requests and retain the locked post-download recheck.

Add a real-lock regression that also verifies network requests do not hold the lock. Extend the QML deadline for the second bounded lock wait. Update usage/development documentation and Unreleased notes; no parity TODO, configuration, or translation changes.