chore(deps): bump hwlocality and passterm, fix non-tty password read

[hubcio]

passterm 2.0.6 broke the non-tty password fallback path.
prompt_password_stdin now calls tcsetattr on STDIN_FILENO
to disable echo, which fails with ENOTTY when stdin is
piped. Replaced with direct stdin read_line, stripping
only line terminators to match passterm's strip_newline
behavior and preserve trailing whitespace in passwords.

• hwlocality: 1.0.0-alpha.11 -> 1.0.0-alpha.12
• passterm: =2.0.1 -> 2.0.6 (exact pin removed)

[codecov]

Codecov Report

❌ Patch coverage is 66.66667% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 70.63%. Comparing base (b05ffa3) to head (8e36249).
⚠️ Report is 1 commits behind head on master.

Files with missing lines	Patch %	Lines
core/cli/src/credentials.rs	66.66%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##             master    #3084      +/-   ##
============================================
- Coverage     70.66%   70.63%   -0.04%     
  Complexity      943      943              
============================================
  Files          1114     1114              
  Lines         94778    94780       +2     
  Branches      71978    71995      +17     
============================================
- Hits          66976    66946      -30     
- Misses        25332    25340       +8     
- Partials       2470     2494      +24     

Components	Coverage Δ
Rust Core	70.72% <66.66%> (-0.03%)	⬇️
Java SDK	62.30% <ø> (ø)
C# SDK	69.11% <ø> (-0.31%)	⬇️
Python SDK	81.43% <ø> (ø)
Node SDK	91.44% <ø> (+0.03%)	⬆️
Go SDK	38.97% <ø> (ø)

Files with missing lines	Coverage Δ
...e/cli/src/commands/binary_users/change_password.rs	88.00% <ø> (ø)
core/cli/src/credentials.rs	85.24% <66.66%> (+0.24%)	⬆️

... and 24 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.