[AnthonyRonning]

The latest master Windows workspace test run fails three updater/lifecycle fixtures: two create a synthetic macOS bundle and ask it to pass Windows installed-root admission, and one expects GPUI restart although Windows uses the stable bootstrap. An earlier Windows run also exhausted the clean integrity fixture's 100 ms budget under load. See the updater/lifecycle failures and integrity budget failure.

Make the controller fixtures hold real OS file locks in the same release-state slot without demanding native admission for a synthetic application. The test guard is compiled only with cfg(test); production retains the exact updater lock type and ownership. Preserve contention/candidate/state/sentinel checks and add missing-lock rejection plus lock release after controller drop.

On Windows, the committed-restart fixture now exercises native bootstrap refusal and retry-state recovery twice, and requires no GPUI restart or premature quit. Existing close/quit and retired-host RPC assertions remain. Give the clean/receipt integrity fixture the same bounded 10-second budget already used by nearby positive fixtures; production budgets and deadline/cancellation negative cases are unchanged.

Validation on macOS with pinned Rust 1.98:

• Integrity module: 23 passed, zero failed, 3 existing isolated-subprocess fixtures ignored; deadline/cancellation cases retained.
• Updater/controller/protocol filter: 33 passed, zero failed/ignored, including both reported controller tests and real lock contention/release.
• Committed restart/quit fixture: 1 passed.
• Pinned formatting, diff checks and independent source review passed.

Hosted Windows and broad CI were not awaited; no native Windows result is claimed for this revision. Full application CI/hooks were intentionally waived. No new ignores, assertion removals or automatic retries were added. Production admission, signature, restart and integrity policies remain intact.