Answer
A user holding the workflow administration permission set can unlock a workflow that's locked by someone else, through the workflow admin's own unlock capability — this is a distinct administrative action from the lock itself, not something the locked-out user can clear on their own.