release

Must be cancellation-safe — callers invoke from finally blocks of fetches that may already be cancelled. A bare mutex.withLock would throw immediately under the cancelled context, leaking the permit; running under NonCancellable lets the brief atomic update always finish.