feat: update admission gate - entries refuse while an update runs (Issue #72, decision 8, U2)

The update skill publishes .mam/update-in-progress (pid + lstart, the
loop_lock.sh rules) while it holds .mam/update-admission.lock exclusively.
create, resume, run_loop.sh and delegate submit (decision 8) and stop and
orc-onboard (U2: a rollback would restore the registry without their write)
take that lock shared (lib.sh mam_update_admit, fd 7), refuse while the marker
is live or unknown, and hold the lock until their record is written. A stale
marker refuses nothing. lib_py.pane_lock acquire gains --shared and
--wait-env (MAM_UPDATE_ADMISSION_WAIT_S, default 120); create's wrapper path
closes fd 7 for the long-lived child. The exit-1 rows of create/resume/stop
name the refusal; skill_code_blocks.json pins follow the shifted lines.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.agents/skills/multi-agent-mux-resume/scripts/resume_session.sh

@@ -172,12 +172,15 @@ if [ "$HERDR_ALIVE" = "1" ]; then
     echo "[dry-run] herdr '$SESSION_NAME' already running — nothing to validate"
     exit 0
   fi
+  # Issue #72: no registry write while an update runs (lib.sh mam_update_admit).
+  mam_update_admit || exit 1
   echo "herdr '$SESSION_NAME' already running."
   # Just update YAML to make sure it's set to running
   CONTROL_PLANE_JSON="$CP_JSON" bash "$(dirname "${BASH_SOURCE[0]}")/update_yaml_resumed.sh" \
     --session "$SESSION_NAME" --uuid "$UUID" --agent "$AGENT" --workspace "$WORKSPACE" \
     --herdr-session "$HERDR_SESSION_NAME" --already-running \
     ${HERDR_WORKSPACE_OPT:+--herdr-workspace "$HERDR_WORKSPACE_OPT"}
+  mam_update_admit_release
   _ensure_monitor_daemon
   exit 0
 fi
@@ -251,6 +254,10 @@ if [ "${DRY_RUN:-0}" = "1" ]; then
   exit 0
 fi
 
+# Issue #72: no new session while an update runs; held until the row is written
+# (lib.sh mam_update_admit).
+mam_update_admit || exit 1
+
 # Issue #63: wait if another same-cwd session of this post-discovered agent
 # is still being created or has not recorded its id yet (lib.sh mam_id_order_wait).
 mam_id_order_wait "$WORKSPACE" "$AGENT" "$SESSION_NAME" "$UUID" || exit 1
@@ -287,6 +294,7 @@ CONTROL_PLANE_JSON="$CP_JSON" bash "$(dirname "${BASH_SOURCE[0]}")/update_yaml_r
   --herdr-session "$HERDR_SESSION_NAME" --cmd-full "$CMD_FULL" \
   ${DROP_FLAG:+$DROP_FLAG} \
   ${HERDR_WORKSPACE_OPT:+--herdr-workspace "$HERDR_WORKSPACE_OPT"}
+mam_update_admit_release
 _ensure_monitor_daemon
 
 echo "Successfully resumed $SESSION_NAME ($AGENT)"