fix(admin): draw the control-byte class at interpreted against composing (#402)

[edgehero]

Closes #402.

The class stopped at what a terminal EXECUTES: C0, DEL and C1, with U+009B in it because a CSI introducer
needs no ESC in front. It excluded bidi and zero-width code points on the ground that a terminal "does not
INTERPRET" them, and that was the wrong reading of its own rule.

A terminal does interpret a bidi override. It reorders everything after it, so repo/safe plus U+202E
plus gnp.txt is drawn as a name ending in .png. The job id, the target and the branch are all attacker-
or model-writable, and a run record is what an operator reads before deciding what to do about it.

The other half is invisibility rather than reordering. deploy-prod and deploy plus U+200B plus
-prod draw as eleven columns each and are not the same trigger, so a picker that selects by the string
acts on the row the operator did not mean. The dialog gate's own ambiguity note, from #404, is about
exactly this and relies on #N prefixes to stay safe.

Where the line is drawn, and how it got there

The rule is INTERPRETED against COMPOSING, and membership is asked of the renderer rather than listed:

• what a terminal executes (C0, DEL, C1),
• or breaks a line (U+2028, U+2029),
• or draws nothing (columnsOf is 0: the format characters, the bidi controls, the fillers, the
  noncharacters),
• or draws a blank a reader cannot tell from a space,
• minus anything that COMPOSES the character beside it, and minus U+0020 itself.

That took three attempts, and the two rejected ones are the interesting part:

1. A hand-written list of the shapes I thought of. It covered 98 code points where this holds 4,024,
   including the Hangul and halfwidth fillers, the entire tag block, and every blank that is not U+0020.
   This repo's own env-file.mjs already names U+3164 as a deception character, so one surface had
   decided the question and mine missed it. It also had no u flag, so 116 of the misses were not
   expressible in it.

2. A category version derived from \p{Cf}|\p{Zl}|\p{Zp}|\p{Zs}. That is a different rule wearing
   this one's clothes: it still left U+FFF0-U+FFF8, which this file's own width table already calls
   noncharacters the renderer draws as nothing, and U+2800, which draws a blank cell.

3. Asking columnsOf alone, which reads like "ask the renderer" and is not. admin: every width promise in the panel is a UTF-16 count, so non-ASCII content breaks the frame #401 pins that table as
   never NARROWER than the renderer and it deliberately answers one column for an unassigned code point,
   because guessing wider is the safe direction for a width. For membership that guess is a MISS, and it
   left 3,760 code points outside the class that the renderer draws at zero: U+2065 and the
   special-purpose plane, a hidden-ASCII channel 39 times the size of the tag block this change builds a
   whole sequence matcher for. Round 2 had rejected the previous version for leaving ten by the same
   substitution of one question for another, so shipping 3,760 would not have been consistent.

Both places the table guesses are now named, measured against the pin. The class holds 4,024 code
points where the first attempt listed 98, and that list is a strict subset of this one.

That change found a defect of its own. Asking "does it draw nothing" put the Indic vowel signs into
the class, because #401 had made a spacing mark measure zero to agree with the renderer while the composing
test was \p{Mn}|\p{Me}. Devanagari \u0915\u093f was substituted to \u0915 -- not revealing a
control, deleting a vowel. Every mark composes, so the test is \p{M}.

U+3000 is deliberately out: an ideographic space draws two columns and is ordinary Japanese text, so
substituting it rewrites content and narrows the line. The collision it can still make is a stated
residual.

The tag block is both things

After U+1F3F4 a tag composes a subdivision flag; anywhere else it is invisible text, and a run of them is a
whole ASCII message at zero columns. So it is settled by SEQUENCE.

A first version of that exemption read "a tag preceded by the base and any number of tags", which is a
prefix test rather than a validity check: it exempted every tag forever after a flag, cancel tag
included, so one legitimate flag emoji anywhere in a model-writable field restored the whole hazard, and a
review pass recovered rm -rf / verbatim from a drawn line. It was also a variable-length lookbehind,
which rescans at every position: 200 KB of tags in one .log line took 2.3 seconds, and readLogTail
bounds the number of lines but not their length. A whole valid sequence is matched now, with no lookbehind:
the same 20,000-tag run went from 296 ms to 6 ms.

One class and one operation

This is the shape the issue left open, and it resolves against a second named operation. The worker escapes
for the same question, and that is not an inconsistency to reconcile: endpointShown's gate is an
allowlist of printable ASCII, right for a DNS name or a socket path, while this panel renders a CJK
repository name as a matter of course. env-file.mjs's QUOTED_CONTROL reaches for the same idea but by
LISTING, which is where this class was two revisions ago.

A regression this change introduced, and fixed

The LIVE_TAIL search could no longer find a line it was drawing: the pane substitutes the class, the search
box deleted it, and the haystack was raw, so for a log line carrying an invisible byte no query matched.
A first repair compared the drawn reading OR the deleted one, which re-merged the very collision the class
exposes -- deploy-prod matched both rows the pane had just learned to tell apart. The search box
substitutes like the pane now, so one reading serves both and typing what is on screen and pasting the
original produce the same query.

What it costs

Two residuals beyond the costs below are stated in the code rather than left implied: the composing
carve-out is also a hidden-text channel (265 default-ignorable code points the renderer draws as nothing,
about 2.8x the tag block, which closing needs the same per-script sequence-awareness the flag has), and
the ASCII fast path only rescues ASCII, so a 200-line tail of 100 KB lines costs about 200 ms a render at
0% non-ASCII and about 4 seconds at 100% CJK.

A correctly isolated right-to-left name now displays worse: the isolate that was making it read
correctly beside an LTR path is substituted, and the panel cannot tell it from an attacker's because they
are the same code point doing the same thing. That is the price of closing the deception, not an oversight.
A soft-hyphenated word and a BOM-led log line each gain a space. And the gate closes the EXPLICIT deception
only: the bidi algorithm reorders neutrals beside a strong RTL character with no control present, which
nothing here can reach without refusing Hebrew and Arabic outright.

Substituting makes a difference visible; it does not say which of two look-alike strings was intended,
because the panel cannot know.

Checked

Mutation-checked at every round; the final set covers the unbounded flag shape, the cancel tag, the tag
minimum, the bounded search window, both composing directions, each arm of the predicate, both places the
width table guesses, and both halves of the search. Two survivors remain and both are genuinely
equivalent, recorded in the code as a pair: the ASCII fast path and the explicit space check each mask the
other's mutation.

The class sweep walks every code point there is and asks the pinned renderer what a code point draws,
with its version asserted, rather than restating the implementation.

Full suite in the CI posture: 4223 tests, 0 fail, 1 skipped. Same under the +399 day clock shift. The
temp-dir, dated-fixture, test-count and revision-row guards all pass, and a run under a fresh TMPDIR leaves
nothing behind.

DES-ADMIN-VIA-PI-EXTENSION amended. OQ-035 amended with it, because scrubReason shares the class. The
worker's validator is UNCHANGED, checked, for the reason DES-ONE-SHOT-DISARM-IN-THE-FILE already records.

No version moved: root and worker 1.10.3, receiver 1.5.0, admin 1.10.2.

Carried from earlier in this round: receiver/src/start.mjs imports @edgehero/pi-dispatch/watch-closer,
which the published worker 1.10.3 does not export, so the next release PR must move the receiver's worker
range to the version that ships it.