fix: address pkce auth review findings

[jgowdy-godaddy]

Summary

Addresses all findings and test gaps from the deep review of #10.

• Finding 1 — Log WARN when the best-effort self-heal delete of a corrupt keychain entry fails, matching the diagnostic pattern in delete_token_from_keychain. Previously the error was silently discarded, causing the corrupt-entry warning to fire on every subsequent load.
• Finding 2 — Fix SAFETY comment in EnvVarGuard::drop to state the invariant directly (XDG_MUTEX is held) without referencing with_xdg_config_home specifically, since the mutex is also acquired directly in some tests.
• Finding 4 — Reject leading space and DEL byte (0x7F) in is_safe_path_component, mirroring the existing trailing-space rejection. A leading space produces an invisible path component in directory listings.
• Finding 5 — Move json into the keychain write closure and return it back, so only one serialized copy of the token material is on the heap at a time in the normal path (eliminates the redundant json.clone()). On task panic/cancel, re-serialize as a fallback.
• Finding 6 — Update list_environments doc comment to explicitly note that file-fallback tokens from a prior session are not enumerated, not just keychain tokens.
• Test gap — Add is_safe_path_component_rejects_empty_string, is_safe_path_component_rejects_leading_space_and_del, list_environments_returns_only_cached_keys, and list_environments_returns_empty_without_cache tests.

Test plan

• cargo fmt --all --check passes
• cargo clippy --all-targets --features pkce-auth -- -D warnings passes
• cargo test --all-targets --features pkce-auth passes (229 tests)
• RUSTDOCFLAGS='-D warnings' cargo doc --no-deps --features pkce-auth passes