fix: close leaked fds in openpty fallback, add static assertions

[rmorgans]

Summary

1. openpty fallback fd leak: the fallback openpty() in master.c (used on platforms without <pty.h>) opens /dev/ptmx but leaks the fd if grantpt(), unlockpt(), or slave open() fails. Fixed with a single goto fail cleanup path.
2. _Static_assert for SCROLLBACK_SIZE: the ring buffer uses & (SCROLLBACK_SIZE - 1) for index wrapping, which requires a positive power of two. Now enforced at compile time. SCROLLBACK_SIZE == 0 is also rejected.
3. _Static_assert for pkt.u.buf: struct packet uses unsigned char len — the buffer must fit in 255 bytes. Now enforced at compile time.

What bugs these fix

• fd leak: on platforms using the fallback openpty, repeated pty allocation failures would exhaust the file descriptor table.
• ring buffer: misconfiguring SCROLLBACK_SIZE to a non-power-of-two or zero would silently corrupt the scrollback buffer. Now caught at compile time.
• packet length: if struct winsize ever exceeded 255 bytes on a platform, pkt.len would silently truncate.

Test results

202/203 pass (1 pre-existing: test 93). ASan+UBSan clean.