fix: gate unsafe set_var behind cfg(windows) in pyhl

[danbugs]

Summary

• Wraps the unsafe { std::env::set_var(...) } call in pyhl::default_surrogate_count() with #[cfg(target_os = "windows")] so the unsafe block only compiles on Windows where surrogate processes actually exist
• Adds a proper # Safety doc section documenting the thread-safety precondition (must be called from main thread before spawning threads or sandboxes)
• On non-Windows platforms the function is now a no-op with no unsafe code

Test plan

• cargo test --lib passes
• cargo clippy -- -D warnings clean
• cargo fmt clean

[github-actions]

Linux Benchmarks

Details

Benchmark suite	Current: 7b7027e	Previous: 86d2609	Ratio
hello_world (median)	20 ms	20 ms	1
pandas (median)	110 ms	110 ms	1
density (per VM)	7 MB	7 MB	1
snapshot (disk)	385 MiB	385 MiB	1

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

Windows Benchmarks

Details

Benchmark suite	Current: 7b7027e	Previous: 86d2609	Ratio
hello_world (median)	179 ms	245 ms	0.73
pandas (median)	531 ms	725 ms	0.73
density (per VM)	6 MB	6 MB	1
snapshot (disk)	392 MiB	392 MiB	1

This comment was automatically generated by workflow using github-action-benchmark.