UPDATE with subquery LIMIT 1 returns multiple rows
It's quite normal you get multiple rows.  The update selects all rows from folder, and for each of them selects a row from folder f2 (I guess the same, if id is PK). If locked = 'available', the record is updated.  On to the next row.

The correct syntax is here, Postgres UPDATE ... LIMIT 1,  and consists in using a CTE.

Without CTE, your result depends on how PostgresSQL decides to execute your update, starting with the outer (multiple rows are possible) or with the inner select.