Panics in exported functions other than compile() abort the process #42

compile wraps its body in catch_unwind (lib.rs:454). No other exported function does: create_compiler (:100), set_sys_inputs (:214), free_compiler (:198), free_compile_result (:482), reset_world. Since Rust 1.81 an uncaught unwind across a "C" boundary aborts, and the crate builds well above that.

Panics reachable in create_compiler today: VirtualPath::new("<main>").expect(...), the file-id budget in #41, and anything inside font enumeration or SystemWorld::new. The VirtualPath unwrap fixed in #37 was one instance of this class, not the class itself.

Two unchecked pointer reads in the same function:

• lib.rs:146, CStr::from_ptr(sys_inputs), with no null check, unlike set_sys_inputs which checks its compiler pointer.
• lib.rs:157, CStr::from_ptr(p) per font path, so a null entry dereferences null.

A guarded function fails one call. An unguarded one takes down every other in-flight request in the process and leaves nothing in the log.

What I would like:

1. catch_unwind in each exported body, converted into the failure the signature already allows: null for create_compiler, false for set_sys_inputs, no-op for the free functions.
2. Null checks on the pointers that are currently read unconditionally.
3. A panic::set_hook capturing message and location, so the reason survives into the .NET exception.

Point 3 needs somewhere to put the message: create_compiler returns a bare null and discards the one world.rs builds. That part overlaps #24.

Happy to send a PR.