[iBobbyTS]

Problem

Switching to a hands-off profile (Silent) submits resetAuto and clears the monitor's fansCurrentlyRunning flag on bookkeeping alone. A fan write already in flight — a ramp tick racing the switch across the monitor/main queues — can land at the daemon after that resetAuto and re-pin the fans in manual, and nothing ever corrects it:

• the flag-driven hands-off branch sees "not running" and stays silent, and
• with the app alive and heartbeating, the daemon watchdog never reclaims the orphaned hold either.

The fans then stay pinned in manual until quit. (Reset to Default has the same shape: its daemon-confirmed resetAuto can still be superseded by an in-flight write.)

Fix

Switching to hands-off (or Reset to Default) now arms a 10-second handback watch instead of submitting a bare resetAuto:

• hands-off ticks read the hardware fan mode and re-send resetAuto at 1Hz while any fan still reads manual, settling once auto is confirmed;
• the watch keeps running past a confirmed-auto reading, so a late re-pin is still caught inside the window;
• it is bounded — a dead daemon or an external tool legitimately holding manual is never fought forever.

To make this testable, the monitor's status source is injected (defaulting to the fanControl reader) and the monitor queue/tick are internal.

Testing

swift build + full swift test pass, including five new hardware-free tests in ThermalMonitorHandbackTests: re-pin before first confirm, re-pin after confirmed auto, clean handback sends nothing, idle hands-off stays quiet in manual, and watch expiry stops retrying.