fix: take the signal-time autosave on the game goroutine (closes #24)

The SIGHUP/SIGTERM handler gob-encoded the live game tree from the signal
goroutine while the game goroutine was mid-turn mutating it, and AutoSave
removed the save file before encoding — so the failure mode was not a
stale save but a deleted one followed by a possibly torn replacement,
with a window in which the player had neither. The suite has run under
-race since 2026-08-09 and was green because nothing had ever driven the
turn loop concurrently with a signal: evidence of untested, not of safe.

The handler no longer writes anything. AutoSaveOnSignal posts a request,
wakes the input read, and waits up to signalSaveTimeout for the game
goroutine to take it; the encode runs on the goroutine that owns the
state, at the three points where that goroutine can sit: between turns
(command), on waking from a blocked readchar, and while parked in the `!`
shell escape (runShellEscape, which now runs the shell on a helper
goroutine so a hangup during it still rescues the game).

Blocked on input is the case that matters — a dropped connection lands
while the player is thinking, so a flag checked only between turns would
never be looked at. Terminal.ReadChar therefore returns (byte, bool),
with ok false meaning "woken by Interrupt, no key", and term.Tcell posts
a tcell.EventInterrupt onto tcell's own event queue to unpark PollEvent.
readchar services the request and reads again, so no caller sees it.

Running the shell on a helper goroutine would also have moved
term.Tcell.ShellEscape's panic on a failed Screen.Resume onto it, and a
panic at the top of any goroutine terminates the process without running
the deferred calls of the others — including cmd/rogue/main.go's
`defer t.Fini()`. The tty would have been left raw on precisely the path
where the terminal is already broken, which is issue #12's failure on a
path this change created. runShellEscape therefore recovers the helper's
panic and re-raises it on the game goroutine, whose stack has the restore
in it, so "every path restores the terminal via Terminal.Fini before
exiting" stays true.

saveFile writes a temporary file in the save's own directory, fsyncs it
and renames it over the target instead of truncating in place, so a save
that fails — or never happens because the deadline ran out — leaves the
player's previous save whole.

What the handoff guarantees is stated exactly rather than flatteringly:
the encode runs on the state-owning goroutine, so the snapshot is
internally consistent and restorable, but it is not necessarily taken
between commands. Only the check at the top of command is; the other two
service points both sit inside a command call already under way. readchar
is reached from mid-command prompts (--More--, askOverwrite, getStr, the
direction and pack prompts) with the command's mutations already applied,
and runShellEscape is reached from shell, an ordinary '!' command handler
dispatched inside command, with that turn's DoDaemons(Before) and
DoFuses(Before) already fired and its AFTER pass not yet. Restoring
re-enters playit at the top of command, so either way the rest of that
command is lost and a fresh BEFORE pass runs on top of the one in the
snapshot.

The SIGINT/SIGQUIT no-save decision and the single-signal-read ordering
guarantee are untouched. pendingSaver reads the game out from under its
mutex rather than delegating with it held, because the delegated call now
blocks until the save is taken.

cmd/rogue/main_test.go

@@ -11,6 +11,7 @@ import (
 	"sync"
 	"syscall"
 	"testing"
+	"time"
 )
 
 // The steps the signal handler can take, in the order signalRecorder
@@ -61,9 +62,13 @@ func newSignalRecorder() *signalRecorder {
 	return &signalRecorder{done: make(chan struct{})}
 }
 
-// AutoSave records a save attempt (the saver half).
-func (r *signalRecorder) AutoSave() {
+// AutoSaveOnSignal records a save attempt (the saver half). The real one
+// hands the work to the game goroutine and waits; the recorder stands in
+// for a game that takes it immediately.
+func (r *signalRecorder) AutoSaveOnSignal(time.Duration) bool {
 	r.record(stepSave)
+
+	return true
 }
 
 // Fini records a terminal restore (the finisher half).
@@ -231,11 +236,12 @@ type blockingSaver struct {
 	extra os.Signal
 }
 
-// AutoSave delivers the extra signal mid-save, then records the save.
-func (b *blockingSaver) AutoSave() {
+// AutoSaveOnSignal delivers the extra signal mid-save, then records the
+// save.
+func (b *blockingSaver) AutoSaveOnSignal(timeout time.Duration) bool {
 	b.queue <- b.extra
 
-	b.rec.AutoSave()
+	return b.rec.AutoSaveOnSignal(timeout)
 }
 
 // TestLeaveOnRealSignal is the deepest headless check available: it
@@ -314,10 +320,63 @@ func TestPendingSaverArmsBeforeTheGameExists(t *testing.T) {
 	// Once the game is handed over, the same saver writes it.
 	started := newSignalRecorder()
 	pending.set(started)
-	pending.AutoSave()
+
+	if !pending.AutoSaveOnSignal(signalSaveTimeout) {
+		t.Error("after set: the save was not reported as taken")
+	}
 
 	saved, _ := started.taken()
 	if want := []string{stepSave}; !slices.Equal(saved, want) {
 		t.Errorf("after set: steps = %v, want %v", saved, want)
 	}
 }
+
+// TestPendingSaverDoesNotHoldItsLockAcrossTheSave pins the reason
+// pendingSaver reads the game out from under the mutex instead of
+// delegating with it held: since issue #24 the delegated save blocks
+// until the game goroutine takes it or the deadline expires, so a mutex
+// held across it would stall whoever calls set. Nothing calls set twice
+// today, which is why the PR #23 review recorded this as a future-proof
+// note rather than a bug — this test is what stops it becoming one.
+func TestPendingSaverDoesNotHoldItsLockAcrossTheSave(t *testing.T) {
+	t.Parallel()
+
+	pending := &pendingSaver{}
+	stuck := &stuckSaver{entered: make(chan struct{}), release: make(chan struct{})}
+	pending.set(stuck)
+
+	go pending.AutoSaveOnSignal(signalSaveTimeout)
+
+	<-stuck.entered // the delegated save is in flight
+
+	done := make(chan struct{})
+
+	go func() {
+		defer close(done)
+
+		pending.set(newSignalRecorder()) // must not block on the save
+	}()
+
+	select {
+	case <-done:
+	case <-time.After(time.Second):
+		t.Error("set blocked while a save was in flight: the lock is held across it")
+	}
+
+	close(stuck.release)
+}
+
+// stuckSaver blocks inside the delegated save until it is released,
+// standing in for a game goroutine that is slow to answer.
+type stuckSaver struct {
+	entered chan struct{}
+	release chan struct{}
+}
+
+// AutoSaveOnSignal blocks until the test releases it.
+func (s *stuckSaver) AutoSaveOnSignal(time.Duration) bool {
+	close(s.entered)
+	<-s.release
+
+	return true
+}