shadow-rs: optimize stderr writes per Copilot review

- show_error!/show_warning!: combine prefix + message into a single
  writeln! call (was two writes: write! then writeln!)
- pam display_message: lock stderr before writing
- passwd PrivDrop::Drop: lock stderr before writing
- pwck check_passwd_entries: hoist stderr lock above the loop so
  per-entry diagnostics reuse one locked handle instead of
  reconstructing it on each iteration

src/shadow-core/src/error.rs

@@ -49,9 +49,7 @@ macro_rules! show_error {
     ($util:expr, $($arg:tt)*) => {
         {
             use std::io::Write as _;
-            let mut err = std::io::stderr().lock();
-            let _ = write!(err, "{}: ", $util);
-            let _ = writeln!(err, $($arg)*);
+            let _ = writeln!(std::io::stderr().lock(), "{}: {}", $util, format_args!($($arg)*));
         }
     };
 }
@@ -62,9 +60,7 @@ macro_rules! show_warning {
     ($util:expr, $($arg:tt)*) => {
         {
             use std::io::Write as _;
-            let mut err = std::io::stderr().lock();
-            let _ = write!(err, "{}: warning: ", $util);
-            let _ = writeln!(err, $($arg)*);
+            let _ = writeln!(std::io::stderr().lock(), "{}: warning: {}", $util, format_args!($($arg)*));
         }
     };
 }

src/shadow-core/src/pam.rs

@@ -340,7 +340,7 @@ fn display_message(message: &PamMessage, _is_error: bool) {
 
     {
         use std::io::Write as _;
-        let _ = writeln!(std::io::stderr(), "{text}");
+        let _ = writeln!(std::io::stderr().lock(), "{text}");
     }
 }
 

src/uu/passwd/src/passwd.rs

@@ -502,7 +502,7 @@ impl Drop for PrivDrop {
             // Failing to restore privileges is a critical error — log it loudly.
             // We can't return an error from Drop, so at least make it visible.
             let _ = writeln!(
-                std::io::stderr(),
+                std::io::stderr().lock(),
                 "passwd: CRITICAL: failed to restore euid to {}: {e}",
                 self.original_euid
             );

src/uu/pwck/src/pwck.rs

@@ -373,6 +373,7 @@ fn check_passwd_entries(
     let mut seen_names: HashSet<&str> = HashSet::new();
     let group_gids: HashSet<u32> = group_entries.iter().map(|g| g.gid).collect();
     let shadow_names: HashSet<&str> = shadow_entries.iter().map(|s| s.name.as_str()).collect();
+    let mut stderr = std::io::stderr().lock();
 
     for entry in passwd_entries {
         // Check 2: Unique and valid usernames.
@@ -427,10 +428,9 @@ fn check_passwd_entries(
             };
             if !home_path.exists() {
                 let _ = writeln!(
-                    std::io::stderr(),
+                    stderr,
                     "user '{}': directory '{}' does not exist",
-                    entry.name,
-                    entry.home
+                    entry.name, entry.home
                 );
                 errors += 1;
             }
@@ -453,10 +453,9 @@ fn check_passwd_entries(
                 && !shell_path.exists()
             {
                 let _ = writeln!(
-                    std::io::stderr(),
+                    stderr,
                     "user '{}': program '{}' does not exist",
-                    entry.name,
-                    entry.shell
+                    entry.name, entry.shell
                 );
                 errors += 1;
             }