fix(example): close the four examples/ review findings

[deadpoets]

The examples/ module had four open findings and no fixes had touched it. For a
library whose examples are its documentation, that was the largest gap left.

password-login — dc28356

• :69 — bufio.NewReader().ReadString() left the password in a 4 KiB
  reader buffer and two immutable Go strings. A string cannot be wiped and none
  of those copies were reachable to try, so only the final []byte was erased —
  in the example whose stated point is that the password stops existing.
• :68 — typed with terminal echo on.

Now read a byte at a time straight into a SecureBuffer, raw mode when stdin is
a TTY. No bufio, no intermediate string, no append growth.

hardened-ssh-agent — 9a7ffe3

• :149 — the README claimed parity with ssh-agent, which calls
  getpeereid on every accept. This one served anyone who could reach the
  socket. Peer uid must now equal ours, root excepted, exactly as ssh-agent
  does.
• :108 — the socket directory was named after the pid. Pids are small and
  enumerable, so a local process could pre-create the directory for likely pids
  and deny the agent a socket. Now MkdirTemp.

Peer credentials come from SO_PEERCRED on Linux and LOCAL_PEERCRED on
darwin/FreeBSD. OpenBSD and NetBSD have no typed accessor in x/sys, so they
refuse to start rather than serve connections they cannot attribute.

Verified

• password-login run end to end with piped stdin: register, correct login, wrong
  password rejected, EOF with no trailing newline, and >256 bytes rejected
  rather than truncated — truncation would let a prefix log in.
• TestPeerUID_ReportsOurOwnUID covers the new gate. A broken peerUID would
  reject every connection and present as a networking fault, not a security
  control misfiring. The reject path needs a second uid and is not reachable
  from a test process.
• Cross-compiles for linux, darwin, freebsd, openbsd, netbsd (amd64 + arm64
  where relevant).
• On Linux: go vet, go build -mod=readonly, go test -race ./... clean
  under GOWORK=off.

go.mod gains golang.org/x/term and promotes golang.org/x/sys to direct.
The secmem and secmem-crypto require lines are untouched.