[yorickdowne]

What I did

1. update could delete a running update's lock file. __lock_file was set before flock -n. When a second ./ethd update lost the race, it exited 1 and __handle_error deleted /tmp/<lock>, which belonged to the update still running. A third update would then create a fresh file, get the lock, and run alongside the first. Now __lock_file is set only after flock succeeds. I tested both versions in the scratch dir while holding the lock: the old one deletes the file, the new one leaves it alone.
2. git checkout main when switching back to main from a tag- ran without ${__as_owner}, so when ethd ran as root or a sudo user, git could write files owned by that user. Also, the pattern ^tag-* matches any branch starting with tag, not just tag-. Both are fixed.
3. __install_docker writes docker.sources but never removed an old docker.list. A host that once had Docker installed by an older ethd, then removed it and ran install again, would fail at apt-get update with "Conflicting values set for option Signed-By". It now deletes docker.list first.