[Mickael-Roger]

Summary

• Serialize workspace provisioning, image updates/recreation, stop/delete, module changes and DeepSeek profile installs with cancellable cross-process locks; reload manifests after acquiring the lock.
• Download Go into private temporary directories with retries and official SHA-256 verification; validate staged extraction before replacing the toolchain and restore the previous installation if replacement fails.
• Lock Go install/uninstall inside the container as well, protecting against orphaned docker exec scripts after a host CLI exits.
• Add regression tests for corrupted archives, rollback, cancellation, cross-process locking and duplicate installation prevention, plus workspace race tests in CI.

Validation

• npm test: passed (Go, package and Bun tests)
• go vet ./...: passed
• git diff --check: passed
• Race tests will run in CI (local environment has no C compiler).

Release

Requested patch release: v2.8.1 after merge and successful CI. The existing tag-driven pipeline sets the npm version and publishes the binaries and base image.