Q:

When exactly does dpkg start and stop being locked?

I'm wondering specifically if it remains locked when only installing one package, and running its postinst. 

A:

dpkg places a file lock on /var/lib/dpkg/lock when a package management process starts and only removes the lock when the package management process ends. 
Please review the Debian Wiki on dpkg and the dpkg manpage for more information on dpkg itself. I will also include a link to dpkg.org which has more specific documentation on the API and file handling of dpkg.
There is also this related stack exchange post discussing how /var/lib/dpkg/lock works. 
As explained in this post when dpkg is used, by either a frontend or dpkg itself, a system call fcntl is called that places an advisory lock. dpkg needs to be able to place this lock and returns false and is unable to proceed if this lock is already in place. Once the functions of dpkg are complete it releases the hold on /var/lib/dpkg/lock freeing up another process to be able to use dpkg.
Importantly, when you receive a warning that there is a lock on /var/lib/dpkg/lock you need to not delete this file but figure out whether there is already a user or process (such as one started by unattended-upgrades) that is currently running a package management process. This process might be hung so you will have to kill it and recover from potential database corruption. This would be completed by following the advice in this related post. I would again caution that deleting the file is not the best way to remove the lock. You need to end the rogue process and potentially repair dpkg if you continue to have issues.
To get to your specific question of:

...if it remains locked when only installing one package, and running its postinst. 

dpkg should only be locked when completing package management processes. A postinst script would likely fall under a package management process, however if it is falling to release /var/lib/dpkg/lock or its variants then that is an issue that should be brought up with the package maintainer(s).

