851f23ebc6
The classic CLI's light-mode detection sends an OSC 11 background-color query and blind-waits 100ms. Terminal managers that swallow OSC 11 (herdr) made every startup pay the full 100ms for nothing, and any in-order relay that answers slower than 100ms (SSH bridges, WSL, loaded tmux servers) delivered the reply AFTER prompt_toolkit owned the tty — the rgb:.../escape payload leaked into the input line as gibberish characters. Fix: send the OSC 11 query followed by a DA1 sentinel (ESC [ c) in one write — the same fence pattern the Ink TUI's TerminalQuerier uses. Terminals answer queries in order and effectively all of them answer DA1, so the DA1 reply proves the terminal has already processed (or ignored) our OSC 11. Fast terminals and herdr-style multiplexers now resolve in ~1ms; slow relays get their reply consumed instead of leaked; a hypothetical DA1-mute terminal falls back at a 1s safety net, same clean timeout path as before. Adds real-PTY regression tests covering the herdr-style (DA1-only), slow-relay (+300ms reply), and fully mute emulator behaviors, each asserting zero leftover bytes in the tty buffer. Sabotage-verified: the slow-relay test fails against the old un-fenced code with the exact leak payload in LEFTOVER.