Fix _Guarded_by_ annotations for m_utilityVm and m_runningInstances

Update SAL annotations from m_instanceLock to m_callbackLock to match
actual locking: mutations are guarded by m_instanceLock, but callback
reads are guarded by m_callbackLock (shared_mutex).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: Ben Hillis

src/windows/service/exe/LxssUserSession.h

@@ -804,8 +804,9 @@ class LxssUserSessionImpl
 
     /// <summary>
     /// Contains the currently running utility VM's.
+    /// Mutations guarded by m_instanceLock; callback reads guarded by m_callbackLock.
     /// </summary>
-    _Guarded_by_(m_instanceLock) std::map<GUID, std::shared_ptr<LxssRunningInstance>, wsl::windows::common::helpers::GuidLess> m_runningInstances;
+    _Guarded_by_(m_callbackLock) std::map<GUID, std::shared_ptr<LxssRunningInstance>, wsl::windows::common::helpers::GuidLess> m_runningInstances;
 
     /// <summary>
     /// Contains a list of instances that have been terminated.
@@ -821,8 +822,8 @@ class LxssUserSessionImpl
     /// <summary>
     /// The running utility vm for WSL2 distributions.
     /// Mutations guarded by m_instanceLock; callback reads guarded by m_callbackLock.
-    ///
-    _Guarded_by_(m_instanceLock) std::unique_ptr<WslCoreVm> m_utilityVm;
+    /// </summary>
+    _Guarded_by_(m_callbackLock) std::unique_ptr<WslCoreVm> m_utilityVm;
 
     /// <summary>
     /// Reader-writer lock protecting m_utilityVm and m_runningInstances for