Live snapshot watchers released CLI admission only when their stream ended, so
exclusive installs never started. Watchers now gate each finite probe, and cached
maintenance resolution takes admission in the caller's context so installer
verification can reenter. Queued installs recheck settings and the update window,
host admission also covers probes from other servers, waiting readers stay
interruptible, lock failures clear stuck update state, and SDK package links no
longer prove manager ownership.