If you can run sudo without a password, you could do something like:
sudo apt update && sudo shutdown -h 5
The && operator will only execute the next instruction if the first returns a zero (no error) code upon completion.
Then just run that command about every 5 minutes and it'll shut down once the install dishes, which releases the lock so apt upgrade can go (presuming apt upgrade needs the lock - I don't remember if it does.)
Alternatively, you could ps auxw | grep for the pid of the upgrade. Then keep running a ps for that pid, and once you don't see it, shutdown.