Add flock-based locking to prevent concurrent service operations

source/agent-remote/common.sh

@@ -180,5 +180,17 @@ _root_remove_tree() {
     docker run --rm -v "$abs_parent":/data alpine rm -rf "/data/$child"
 }
 
+# Acquires an exclusive lock on a service directory to prevent concurrent operations.
+# Uses flock() which is automatically released when the process exits (even on crash/SIGKILL).
+_lock_service() {
+    local service_dir="$1"
+    local lockfile="${service_dir}/.deploy.lock"
+    mkdir -p "${service_dir}"
+    exec 200>"${lockfile}"
+    if ! flock -n 200; then
+        _die "Another operation is already running on this service. Aborting."
+    fi
+}
+
 # Load autocommands
 source "${AGENT_PATH}/datacommands_v2.sh"