Serialization belongs in post-receive, not the deploy client

gitdeploydev.sh cannot serialize dev deploys: the build runs server-side in the bare repo's post-receive hook on any 'git push dev HEAD:dev', so a lock in the client script (or a wrapper around it) misses hand pushes entirely - documented in the script itself (line ~102, v2.16 block). Trap-release also fires on client timeout while the server build is still running (lines 526-529), and EXIT traps never fire on SIGKILL - trap is not a release guarantee, ttl is. Found 2026-09-08 by bin-lezama-cc + bin-whey-cc independently, in response to an mba-l change request for lock/extend/unlock in gitdeploydev.sh. mba-l decision (coder02-mba-l-cc): build nothing client-side, not even best-effort - a documented caveat does not survive a tired 3am reader trusting 'lock held' as real exclusion. Correct fix: mutual exclusion at the TOP of the bare repo's post-receive hook, the only point every push actually converges on, with hub lock renewal tied to build-progress evidence (e.g. tailing the remote build log), never to client/child-process liveness - coder-llmmsgsrv-cc's own 2026-09-08 caution against polling-loop renewal applies here: renewing for the lifetime of a blocking push is the wedged-agent pattern the hub warns against.