fix: defensive checks for cwd restore, malloc, and log writes

[rmorgans]

Summary

Three small defensive fixes:

1. socket_with_chdir: always restore cwd after socket operation, even on failure. Preserves errno so the caller sees the original error.
2. expand_sockname: check malloc() return before use. Exits with error instead of passing NULL to snprintf (undefined behavior).
3. rotate_log / pty_activity: once logging is disabled (log_fd = -1), no code path touches the fd again. Early guard in rotate_log(), split guard blocks in pty_activity(), and correct return value from open_log().

What bugs these fix

• cwd: after a failed socket operation with a long path, the process could remain in the wrong working directory.
• malloc: on OOM, expand_sockname would call snprintf(NULL, ...) — undefined behavior.
• log: a write failure would close the log fd but subsequent code still incremented log_written, called rotate_log(), and lseek() on the invalid fd.

Test results

202/203 pass (1 pre-existing: test 93). ASan+UBSan clean.