Is it possible to temporarily 'lock' content authoring during an installation / maintenance window , for example while packages / bundles are being installed?
I do not believe the server is available during an upgrade installation but during the routine maintenance e.g. workflow purge, DataStore Garbage Collection, ..etc Ideally you should not let any access. You can block access via dispatcher.
You do this by setting up a maintenence page at either CDN/dispatcher level. Whenever you would like to lock authoring, you can show the maintanence page.
Another option is to write custom code using the lock/unlock function of Page API[1] and lock the pages when installation/maintenece is going on. You can unlock the pages once activity is completed.