Make TTY raw-mode changes fallible and restore terminal state

Context

Both TTY host functions discard the result returned by crossterm:

• src/lib.rs:1999-2007

The public functions are therefore typed as infallible in platform/Tty.roc:13-18, even when stdin is not a terminal or the OS rejects the operation.

The host also does not visibly track whether it enabled raw mode or guarantee restoration when the Roc application returns an error or crashes. #69 previously tracked panic restoration and was closed, but the current implementation still ignores errors and calls roc_main without a raw-mode cleanup guard at src/lib.rs:2112-2124.

Suggested direction

• Return a typed error from enable/disable operations.
• Track raw-mode ownership so the host only restores a mode it enabled.
• Install cleanup around roc_main for normal return and Roc crash/expect paths.
• Document what can and cannot be guaranteed for external termination signals.

A small RAII guard in the Rust host may make the normal and unwinding paths easier to reason about, although the release profile uses panic = "abort" and therefore also needs explicit crash-handler consideration.

Acceptance criteria

• Enabling or disabling raw mode reports OS errors to Roc.
• Raw mode is restored after normal success and application-level error returns.
• Raw mode restoration is tested for the Roc crash/expect path supported by the host.
• Repeated enable/disable calls have defined behavior.
• PTY integration tests verify the terminal state after the child exits.

Start with the TTY host functions in src/lib.rs:1999-2007 and the public types in platform/Tty.roc:13-18, then inspect the roc_main call at src/lib.rs:2112-2124. Define ownership and error behavior for repeated raw-mode operations, and use PTY integration tests to verify restoration after normal returns, application errors, and the supported Roc crash/expect path.