fix: take the signal-time autosave on the game goroutine (closes #24)

The SIGHUP/SIGTERM handler gob-encoded the live game tree from the signal
goroutine while the game goroutine was mid-turn mutating it, and AutoSave
removed the save file before encoding — so the failure mode was not a
stale save but a deleted one followed by a possibly torn replacement,
with a window in which the player had neither. The suite has run under
-race since 2026-08-09 and was green because nothing had ever driven the
turn loop concurrently with a signal: evidence of untested, not of safe.

The handler no longer writes anything. AutoSaveOnSignal posts a request,
wakes the input read, and waits up to signalSaveTimeout for the game
goroutine to take it; the encode runs on the goroutine that owns the
state, at the three points where that goroutine can sit: between turns
(command), on waking from a blocked readchar, and while parked in the `!`
shell escape (runShellEscape, which now runs the shell on a helper
goroutine so a hangup during it still rescues the game).

Blocked on input is the case that matters — a dropped connection lands
while the player is thinking, so a flag checked only between turns would
never be looked at. Terminal.ReadChar therefore returns (byte, bool),
with ok false meaning "woken by Interrupt, no key", and term.Tcell posts
a tcell.EventInterrupt onto tcell's own event queue to unpark PollEvent.
readchar services the request and reads again, so no caller sees it.

saveFile writes a temporary file in the save's own directory, fsyncs it
and renames it over the target instead of truncating in place, so a save
that fails — or never happens because the deadline ran out — leaves the
player's previous save whole.

The SIGINT/SIGQUIT no-save decision and the single-signal-read ordering
guarantee are untouched. pendingSaver reads the game out from under its
mutex rather than delegating with it held, because the delegated call now
blocks until the save is taken.

game/command.go

@@ -8,6 +8,13 @@ package game
 func (g *RogueGame) command() {
 	p := &g.Player
 
+	// Between turns is the one point in the loop where the game state is
+	// whole, so it is where a signal-triggered autosave is answered when
+	// the game goroutine is busy rather than waiting for a key (issue
+	// #24). The other service points are readchar (io.c) and shell,
+	// covering the two ways this goroutine can be parked.
+	g.serviceAutoSaveRequest()
+
 	ntimes := 1 // number of player moves
 	if p.On(Hasted) {
 		ntimes++
@@ -890,7 +897,7 @@ func (g *RogueGame) shell() {
 	if se, ok := g.scr.term.(interface{ ShellEscape() }); ok {
 		g.InShell = true
 
-		se.ShellEscape()
+		g.runShellEscape(se)
 
 		g.InShell = false
 		g.refresh()
@@ -898,3 +905,32 @@ func (g *RogueGame) shell() {
 		g.msg("shell escape is not available")
 	}
 }
+
+// runShellEscape runs the shell and returns when it exits, answering
+// signal-triggered autosave requests in the meantime (issue #24).
+//
+// The shell blocks for as long as the player is away — minutes, or until
+// they forget — and a line dropping while they are in it is exactly the
+// case SIGHUP autosave exists for, so this goroutine cannot simply sit
+// inside the call. The shell runs on a helper goroutine and the game
+// goroutine waits here, still the only one that ever encodes game state.
+// It draws nothing while it waits, so the suspend/resume dance is as
+// undisturbed as it was when it ran inline (ARCHITECTURE.md section 9).
+func (g *RogueGame) runShellEscape(se interface{ ShellEscape() }) {
+	done := make(chan struct{})
+
+	go func() {
+		defer close(done)
+
+		se.ShellEscape()
+	}()
+
+	for {
+		select {
+		case <-done:
+			return
+		case req := <-g.sigSave:
+			g.runAutoSaveRequest(req)
+		}
+	}
+}