feat: update admission gate - entries refuse while an update runs (Issue #72, decision 8, U2)

The update skill publishes .mam/update-in-progress (pid + lstart, the
loop_lock.sh rules) while it holds .mam/update-admission.lock exclusively.
create, resume, run_loop.sh and delegate submit (decision 8) and stop and
orc-onboard (U2: a rollback would restore the registry without their write)
take that lock shared (lib.sh mam_update_admit, fd 7), refuse while the marker
is live or unknown, and hold the lock until their record is written. A stale
marker refuses nothing. lib_py.pane_lock acquire gains --shared and
--wait-env (MAM_UPDATE_ADMISSION_WAIT_S, default 120); create's wrapper path
closes fd 7 for the long-lived child. The exit-1 rows of create/resume/stop
name the refusal; skill_code_blocks.json pins follow the shifted lines.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.agents/skills/multi-agent-mux-delegate-job/multi-agent-mux-delegate-job

@@ -301,6 +301,10 @@ cmd_submit() {
   local reg_dry=()
   if [[ "$DRY_RUN" == "1" ]]; then reg_dry=(--dry-run); fi
 
+  # Issue #72: no job is registered while an update of the target's workspace
+  # runs; held until the record is written (lib.sh mam_update_admit). A
+  # dry-run record is never dispatched and is not counted by the update.
+  if [[ "$DRY_RUN" != "1" ]]; then mam_update_admit "$WORKSPACE_ROOT" || exit 1; fi
   # 1) register job (prints the new job id)
   JOB_ID="$("$PY" "$SCRIPT_DIR/scripts/registry.py" --registry-dir "$REGISTRY_DIR" register \
       "${reg_prompt[@]}" --agent "$AGENT" --agent-session "$AGENT_SESSION" --role "$DELEGATE_ROLE" \
@@ -310,6 +314,7 @@ cmd_submit() {
       --job-type "$TYPE" --reviewer "$REVIEWER" --reviewer-session "$REVIEWER_SESSION" \
       --max-iterations "$MAX_ITERATIONS" ${reg_parent[@]+"${reg_parent[@]}"} ${reg_dry[@]+"${reg_dry[@]}"})"
   echo "registered job: $JOB_ID"
+  [[ "$DRY_RUN" == "1" ]] || mam_update_admit_release
 
   # 1-1) Provision job directory and write direct brief.md (MAM Job Restructuring)
   local job_dir="$REGISTRY_DIR/$JOB_ID"