Wait for apt lock during deploy on fresh Ubuntu hosts.

Avoid failing Node install when unattended-upgrades holds dpkg; poll up to 10 minutes then retry.

Co-authored-by: Cursor <cursoragent@cursor.com>

deploy/manage.sh

@@ -42,6 +42,23 @@ ensure_git_cli() {
   fi
   if command -v apt-get >/dev/null 2>&1; then
     export DEBIAN_FRONTEND=noninteractive
+    # 新机常撞 unattended-upgrades 占锁；最多等 10 分钟
+    local waited=0
+    while pgrep -x unattended-upgr >/dev/null 2>&1 \
+      || pgrep -x apt-get >/dev/null 2>&1 \
+      || pgrep -x apt >/dev/null 2>&1 \
+      || pgrep -x dpkg >/dev/null 2>&1 \
+      || { command -v fuser >/dev/null 2>&1 && fuser /var/lib/dpkg/lock-frontend >/dev/null 2>&1; }; do
+      if [[ "${waited}" -eq 0 ]]; then
+        echo "等待 apt 锁释放（unattended-upgrades）…"
+      fi
+      if [[ "${waited}" -ge 600 ]]; then
+        echo "错误: 等待 apt 锁超时，请稍后再试" >&2
+        exit 1
+      fi
+      sleep 5
+      waited=$((waited + 5))
+    done
     apt-get update -qq
     apt-get install -y git ca-certificates curl
   else