The shared-file handling is check-then-act (CountByImage, then remove/write):
two concurrent deletes on albums sharing one file could both see refs>1, both
skip removal, and both clear their rows — leaving the file orphaned with no
remaining reference for the purge GC to find. Serialize album image
operations behind a mutex; they are rare, admin-gated actions.