Probes, auth, ACP spawns, OpenCode commands, managed refreshes and text
generation now hold a shared launch permit that installs take
exclusively, with reentry for an install's own verification. Launches
still run side by side, so a probe or a title never delays a turn.

Installs drain host leases before closing admission, and background
installs run after the update window check releases admission, so a
session holding a lease can always finish launching its CLI.

The update window stops at the first blocker, rechecks recent
interaction before installing, and leaves frequent scheduled tasks out
of its query unless they run. Idle foreground mobile clients no longer
count as interaction.