fix: tear down Windows async read machinery in stop_tty before closing handle
stop_tty() was closing the console handle without first unregistering
the RegisterWaitForSingleObject callback or detaching the line-mode
reader thread. This opened two races:
1. The wait callback holds a raw pointer to internal_wait_waker; if
the handle is closed and the uv_tty_t freed before
UnregisterWaitEx, the callback can wake through freed memory.
2. The detached line-read thread could still be using the HANDLE
while close was happening.
Add close_tty_read() that tears down the wait registration (blocking
until any in-flight callback completes via INVALID_HANDLE_VALUE),
drops the waker, and detaches from any in-flight line-mode read.
Call it from stop_tty() before CloseHandle/_close.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>