chore(safety): two .133 gate findings — cfg the abi lock helper, re-anchor a layer proof

The tray leg builds punktfunk-core with default-features off, where
lock_recover's only callers (the quic-gated punktfunk_connection_* entry
points) do not exist — dead code under -D warnings. The helper takes the
same feature gate.

In pf-vkhdr-layer, rustfmt had reflowed destroy_surface's lookup into a
multiline closure, leaving the SAFETY comment outside the closure that
contains its unsafe block — the box's clippy rightly stopped accepting the
adjacency. The comment moves inside, directly above the block.

crates/punktfunk-core/src/abi.rs

@@ -59,6 +59,9 @@ use std::ptr;
 /// for. The slots behind these mutexes are plain last-value caches (frame/audio/cursor/clip), so
 /// whatever a poisoned writer left behind is still structurally valid data to overwrite or hand
 /// out; recovering the guard is strictly better than aborting the embedding application.
+/// (`quic`-gated with its only callers, the `punktfunk_connection_*` entry points — a
+/// `default-features = false` consumer like the tray would otherwise see dead code.)
+#[cfg(feature = "quic")]
 fn lock_recover<T>(m: &std::sync::Mutex<T>) -> std::sync::MutexGuard<'_, T> {
     m.lock().unwrap_or_else(std::sync::PoisonError::into_inner)
 }

packaging/windows/pf-vkhdr-layer/src/lib.rs

@@ -904,15 +904,12 @@ unsafe extern "system" fn destroy_surface(
     if let Ok(mut m) = surface_hwnds().lock() {
         m.remove(&surface.as_raw());
     }
-    let down = instances()
-        .lock()
-        .ok()
+    let down = instances().lock().ok().and_then(|g| {
         // SAFETY: vkDestroySurfaceKHR requires `inst` to be a live instance handle — a
         // dispatchable object whose first word is the dispatch key.
-        .and_then(|g| {
-            g.get(&unsafe { key(inst.as_raw()) })
-                .and_then(|d| d.destroy_surface)
-        });
+        g.get(&unsafe { key(inst.as_raw()) })
+            .and_then(|d| d.destroy_surface)
+    });
     if let Some(f) = down {
         // SAFETY: `f` is the down-chain vkDestroySurfaceKHR resolved for this instance at
         // create time; forwarding the caller's own arguments unchanged.