Looking at the docs, seems like the CLI has some info, that the reboot command and the shutdown command are also blocked by the update lock,.
Could you try running the command with adding --data '{"force": true}'?
curl -X POST --header "Content-Type:application/json" --data '{"force": true}' "$RESIN_SUPERVISOR_ADDRESS/v1/reboot?apikey=$RESIN_SUPERVISOR_API_KEY"
My guess is that the docs got out of sync and have to add there that the update lock blocks these actions too.
As for the update on reboot, that sounds a tricky criteria. With containerised apps, their uptime and system uptime is separated. It looks to me that uptime shows the system uptime in the application container, so could possibly implement an update trigger in your application that depends on the system uptime.
Just something to note, that the supervisor takes some time to start up, and at startup there’s a ~30 window at the moment when your application might be already running, but the supervisor not running yet (some more info in this conversation).