Hold the share_enrollment lock for the patch's transaction

Enrollment share migration now uses a FOR UPDATE row lock; overlapping runs block before reading and see the first run's shares.