[cyruszhang]

Concurrent Windows session workers can both observe an empty lock file. One worker may lock its first byte before the other writes the initialization byte, causing PermissionError; cleanup then attempts to release a lock that was never acquired and can leak the descriptor. This caused the Native Windows failure on #99.

Remove the initialization write: Windows byte-range locks support locking beyond EOF. Release only successfully acquired locks and always close the descriptor, including when acquisition or release fails. Existing one-byte lock files remain compatible.

Validation:

• Host-core suite: 712 passed, 3 skipped locally.
• Four new regressions cover empty-file initialization, acquisition failure, release failure, and critical-section failure; existing multiprocess concurrency coverage runs on native Windows in CI.
• Targeted Ruff checks and git diff --check pass.

Windows API behavior: https://learn.microsoft.com/en-us/cpp/c-runtime-library/reference/locking

CI prerequisite shared with #101: refresh the standalone Context lockfile from aiohttp 3.14.3 to the workspace's existing 3.14.5, with its required yarl update, to resolve three audit findings. Standalone pip-audit reports no known vulnerabilities.