LwMutex: Take the lock after a callback if it was released during it

The end callback checked the kernel object's lockThread, which for an
lwmutex is only refreshed by sceKernelReferLwMutexStatus. The lock state
lives in the workarea, so an unlock during the callback left the waiter
waiting forever. Verified against pspautotests threads/lwmutex/callbacks.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

Core/HLE/sceKernelMutex.cpp

@@ -826,7 +826,8 @@ static void __KernelWaitLwMutex(LwMutex *mutex, u32 timeoutPtr) {
 
 static bool __KernelUnlockLwMutexForThreadCheck(LwMutex *mutex, SceUID threadID, u32 &error, int result, bool &wokeThreads)
 {
-	if (mutex->nm.lockThread == -1 && __KernelUnlockLwMutexForThread(mutex, mutex->nm.workarea, threadID, error, 0))
+	// The lock state lives in the workarea, nm.lockThread is only refreshed when referred.
+	if (mutex->nm.workarea->lockLevel == 0 && __KernelUnlockLwMutexForThread(mutex, mutex->nm.workarea, threadID, error, 0))
 		return true;
 	return false;
 }