ci: serialize deployments and restore previous release on smoke failure

scripts/docker-update.sh

@@ -18,6 +18,10 @@ set -uo pipefail
 DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 cd "$DIR" || exit 2
 
+# Share the CI lock before pulling or touching the live application.
+exec 9>"$DIR/.deploy.lock"
+flock -w 1800 9 || exit 2
+
 LOG_FILE="${LOG_FILE:-$DIR/logs/docker-update.log}"
 PM2_APP="${PM2_APP:-next}" # host-side CMS that must stay stopped (port 3002)