Replace migrate with manifest-driven advance-channel and add the release lock

bin/repo advance --from/--to moves packages forward through the pipeline
(edge → rc → stable), driven by the source channel's database rather than the
raw directory, copying packages AND their detached signatures (fixing the old
migrate bug that left promoted packages unverifiable), refusing to rewrite any
published filename, and requiring a .sig for everything it moves. stable → rc
is allowed only as --fast-ring parity replication or the one-time
--bootstrap seed (bin/repo bootstrap-rc). 'migrate' stays as a deprecated
alias for the transition.

helpers/lock-helpers.sh adds a host-wide flock shared by bin/release,
advance-channel, and upload-prebuilt (reentrant via OMARCHY_RELEASE_LOCK_HELD)
so timers and operators serialize instead of interleaving partial publishes.

bin/release gains a stable-only step 7: replicate fast-ring artifacts to rc so
rc and stable stay in parity between release trains (skipped until rc is
bootstrapped).

bin/release

@@ -6,6 +6,7 @@ set -e
 BUILD_ROOT=$(realpath "${BASH_SOURCE[0]%/*}/..")
 source "$BUILD_ROOT/helpers/message-helpers.sh"
 source "$BUILD_ROOT/helpers/paths.sh"
+source "$BUILD_ROOT/helpers/lock-helpers.sh"
 source "$BUILD_ROOT/helpers/basecamp-notifier.sh"
 
 SYNC_REMOTE=""
@@ -85,6 +86,12 @@ print_info "Target architecture: $ARCH"
 print_info "Mirror: $MIRROR"
 print_info "Build workspace: $BUILD_OUTPUT_DIR"
 
+# One channel mutation at a time: a timer firing mid-run or a second operator
+# waits here instead of interleaving a partial publish.
+if [[ "$DRY_RUN" != true ]]; then
+  acquire_release_lock || exit 1
+fi
+
 # Step 1: Build
 echo ""
 if [[ "$DRY_RUN" == true ]]; then
@@ -156,5 +163,25 @@ fi
   exit 1
 }
 
+# Step 7 (stable only): fast-ring packages publish to rc and stable together,
+# so rc never falls behind what stable users actually run. Skipped until the
+# rc channel has been bootstrapped.
+if [[ "$MIRROR" == "stable" ]]; then
+  echo ""
+  if [[ -f "$REPO_ROOT/rc/$ARCH/omarchy.db.tar.zst" ]]; then
+    print_info "Step 7: Replicating fast-ring packages to rc (parity)..."
+    REPLICATE_ARGS=(--from stable --to rc --fast-ring --arch "$ARCH")
+    [[ -n "$SYNC_REMOTE" ]] && REPLICATE_ARGS+=(--sync-remote "$SYNC_REMOTE")
+    [[ "$SKIP_PROD_CHECK" == true ]] && REPLICATE_ARGS+=(--skip-prod-check)
+    "$BUILD_ROOT/bin/advance-channel" "${REPLICATE_ARGS[@]}" || {
+      print_error "Fast-ring replication to rc failed"
+      notify_error "Release failed: rc parity replication failed" "Mirror: $MIRROR | Arch: $ARCH"
+      exit 1
+    }
+  else
+    print_info "rc channel not bootstrapped; skipping fast-ring replication"
+  fi
+fi
+
 echo ""
 print_success "Release workflow completed successfully!"