[vu1n]

A concurrent fork can retain the managed-turn lock's open file description after its owner drops, so the next turn incorrectly reports that the session is still in progress. The parallel invocation-store regression forks the test process and holds inherited descriptors, providing a concrete source for the recurring macOS CI race. Closing only the parent's descriptor cannot release that shared flock.

Explicitly unlock in ManagedTurnLock::drop, matching the invocation-store lock's existing behavior. Keep nonblocking same-session exclusion and independent sessions unchanged. Add a deterministic duplicate-descriptor regression covering release before the duplicate closes, rejected contenders, and successor ownership; update the feature map. No sleeps, retries, or weakened assertions.

Validation:

• New regression fails on the original implementation with the same “already has a turn in progress” error, then passes with this fix.
• Local cargo test --locked --no-default-features --all-targets: 1,003 passed, 6 existing ignored.
• Local cargo clippy --locked --no-default-features --all-targets -- -D warnings, cargo fmt --check, featuremap.py check, and git diff --check: passed.
• CI run 41428125006 passed all four jobs for head c0bafd3: macOS, Ubuntu, libkrun, and Cloudflare gateway. Both managed-turn lock tests passed in all three Rust jobs. macOS/Ubuntu each passed 947 unit tests plus 56 integration tests; libkrun passed 1,150 unit tests plus 56 integration tests.

Runner image publication and live-session/VM qualification remain separate. The libkrun CI job builds, lints, and runs non-VM tests; no deployment or live infrastructure run is included.