Record MutexGuardpub

Linear guard that MUST release the underlying lock on drop. The spec declares this local so the locality check at .spawn prevents capture; that attribute is omitted here because the current checker rejects local types in return positions (see divergence #1 above). The spec-mandated :dispose impl lives with the real lock/unlock implementation.