fix: drop manifest entries with no download source

install.py fetches a file from its repo_path or from a release asset.
Resolution can land on a file the database does not index, and the
entry then shipped with neither: a line in the download list that can
only ever fail. Those are recorded as omitted instead, which is what
the installer already knows how to report, and a test holds the
committed manifests to it.

validate_schemas read dist/ while a build was writing it and reported
a half-written pack as 'File is not a zip file'. It takes the shared
lock --verify-packs uses, and says so when a build holds it.

scripts/validate_schemas.py

@@ -77,9 +77,30 @@ def _validate_pack_manifests(dist: Path) -> list[str]:
     generate_pack.py writes manifest.json inside the archive, not beside it,
     so a filesystem glob over dist/ matches nothing and silently validates
     zero documents.
+
+    Reading a pack while a build is writing it reports "File is not a zip
+    file" about an archive that is merely half-written, so this takes the same
+    shared lock --verify-packs does. A build holding the exclusive lock means
+    the packs on disk are mid-flight and there is nothing stable to validate.
     """
     if not dist.is_dir():
         return []
+
+    sys.path.insert(0, str(ROOT / "scripts"))
+    from common import ArtifactLockBusy, artifact_lock
+
+    try:
+        with artifact_lock(str(dist), exclusive=False):
+            return _scan_pack_manifests(dist)
+    except ArtifactLockBusy:
+        print(
+            f"note: {dist.name} is being written; skipping pack manifests",
+            file=sys.stderr,
+        )
+        return []
+
+
+def _scan_pack_manifests(dist: Path) -> list[str]:
     validator = _validator("pack-manifest.schema.json")
 
     def _label(path: Path) -> str: