cleanup: fix file descriptor leak in cleanup_lockfiles

[ranga-nir]

• Have you followed the guidelines in our Contributing document?
• Have you checked to ensure there aren't other open Pull Requests for the same change?
• Have you added an explanation of what your changes do and why you'd like us to include them?
• Have you written new tests for your changes? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) with your changes locally?

---

• AI was used to generate or assist with generating this PR. Please specify below how you used AI to help you, and what steps you have taken to manually verify the changes.

---

cleanup_lockfiles leaks file descriptors by calling file.open without saving or closing the handle. Fixed by storing the handle and closing it on all code paths.