Make OS lease guards prove process-bound release across inherited descriptors #718

Idea

Treat an operating-system file lease as an explicit process-bound authority guard rather than an owned File whose close is assumed to release authority.

Rust's Unix file-lock contract maps File::try_lock to flock and retains the lock until every duplicated or inherited descriptor is closed, unless File::unlock is called. O_CLOEXEC still leaves a fork-to-exec inheritance window. The writer-epoch lease exposed this distinction when a musl test attempted immediate takeover while another test spawned a child process.

A reusable internal lease guard could make the contract executable:

• acquisition owns the exact OS lock capability;
• an explicit fallible release path unlocks before close when the caller needs a typed outcome;
• Drop performs a best-effort unlock fallback;
• duplicated/inherited-descriptor tests prove release does not depend on the last descriptor closing;
• platform-specific posture is explicit rather than inferred from an empty error set.

Acceptance

• Specify whether lease authority is bound to a process, an open-file description, or another named owner.
• Add a deterministic duplicated-descriptor conformance witness.
• Add a bounded fork-to-exec witness on supported Unix targets without timing sleeps.
• Distinguish explicit release success, fallback-on-drop, and release obstruction where that distinction is authoritative.
• Keep the guard internal until a second real lease consumer establishes a reusable public shape.
• The abstraction must not weaken live-writer exclusion or permit a forked child to continue writing without fresh admission.

This is a design follow-up, not a blocker for the narrow PR #716 CI repair.