fix: serialize complete upgrade operations

[shakkernerd]

Summary

• hold the per-environment operation lock for the complete normal upgrade lifecycle
• use locked binding, service, snapshot restore, and rollback paths while that lock is held
• add a process-level regression test proving competing environment mutations wait and then continue

Verification

• AWS Crabbox: cargo test --locked
• AWS Crabbox: cargo check --locked --all-targets
• AWS Crabbox: cargo check --locked --target x86_64-pc-windows-gnu
• AWS Crabbox: all 42 upgrade integration tests, including the new concurrent-mutation test
• cargo fmt --check
• git diff --check

[shakkernerd]

Merged using rebase.

What changed after review:

• Held the per-environment operation lock for the complete normal upgrade lifecycle.
• Used non-relocking binding, service, snapshot restore, and rollback paths while the lock is held.
• Added process-level coverage for a competing environment mutation waiting and then continuing.

Verification:

• AWS Crabbox cbx_a55a7013c2d7: full cargo test --locked, all-target checks, and Windows GNU compile passed.
• All 42 upgrade integration tests passed, including the concurrent-mutation regression.
• Auto-review: lock ordering, nested mutation paths, rollback recovery, and sibling environment/service callers reviewed clean.
• GitHub checks: all required checks green on the prepared head.

Landed on main:

• Final landed SHA: 3a76b99; range b623410...3a76b99.

Thanks @shakkernerd!