Auto-updater: two concurrent sessions race on the npm-global install and delete the claude package (dangling symlink, 'command not found')

**Environment:** Claude Code 2.1.266, npm-global install (`npm install -g @anthropic-ai/claude-code`) under Homebrew node; npm 11.12.1; Node 25.9.0; macOS 26.x (Darwin 25.6.0), Apple Silicon.

**What happened**
Two Claude Code sessions launched ~90 ms apart (one interactive session in one project dir, one
in another dir with a different `CLAUDE_CONFIG_DIR`). Each started its own background auto-update:
`npm install --global @anthropic-ai/claude-code@2.1.266`. Both npm runs "retired" the live package
dir to the same temp path (`/opt/homebrew/lib/node_modules/@anthropic-ai/.claude-code-2DTsDk1V`).
One run ended with `error process terminated / error signal SIGHUP / exit 1`; the other logged
`exit 0 / info ok`. Afterward `/opt/homebrew/lib/node_modules/@anthropic-ai/` was empty and
`/opt/homebrew/bin/claude` was a dangling symlink, so every new shell got
`claude: command not found` until a manual `npm install -g @anthropic-ai/claude-code@2.1.266`.

**Expected**
The updater should take a lock (or skip when another update is already in flight) so two
concurrent sessions cannot clobber the shared global install.

**Repro**
1. npm-global install of Claude Code, auto-updates enabled, a newer version available.
2. Start two `claude` sessions at the same moment (e.g. a shell alias in one terminal while
another session boots).
3. Observe two `npm install --global` debug logs with near-identical timestamps in `~/.npm/_logs/`
and a missing package dir afterward.

**Evidence**
- `~/.npm/_logs/2026-09-09T14_02_34_904Z-debug-0.log` and `…14_02_34_992Z-debug-0.log`
(both `install --global @anthropic-ai/claude-code@2.1.266`); preceding
`npm view @anthropic-ai/claude-code@latest version --prefer-online` log at `14_02_33`.
- Symlink mtime 07:05:03 PDT; reinstall 07:08.
- npm v11.12.1, Node v25.9.0, macOS Darwin 25.6.0 (Apple Silicon), Claude Code 2.1.266.

Start by finding the background auto-updater path that runs `npm view @anthropic-ai/claude-code@latest` and `npm install --global @anthropic-ai/claude-code@...`. Reproduce with two `claude` sessions launched together from an npm-global install, then inspect the npm logs under `~/.npm/_logs/`. Done means concurrent sessions no longer leave an empty package directory or dangling `/opt/homebrew/bin/claude` symlink.

Vom Indexierungsmodell aus dem Issue-Text verfasst.