- Handle poisoned mutex in recover_pending_termios with into_inner()
  to ensure terminal recovery even in edge cases (233 #1)
- Add comment explaining double-close safety: longjmp skips File
  destructor so fd is still open and cannot be reused (233 #2)
- Add comment explaining the intentional if guard in
  write_empty_password as release-build safety net (231 #2)

Co-Authored-By: Claude Opus 4.6 <[email protected]>

- Fix fd leak when PENDING_TERMIOS_RESTORE mutex is poisoned after
  successful tcgetattr (finding #2)
- Restore comment explaining intentional if guard in write_empty_password
  for release builds where debug_assert is stripped (finding #3)
- Document that rpassword's internal fd leaks on longjmp as a known
  minor limitation (finding #1)
- Note UTF-8 restriction from rpassword vs previous raw bytes (finding #4)

Co-Authored-By: Claude Opus 4.6 <[email protected]>