feat(qt): add bounded system paste entries - #324

Shift+Insert is now an implemented paste shortcut and must be accepted without
falling through as an Insert byte. Disable the reader in this local test so it
never touches a personal clipboard; the existing literal receiver bytes stay
unchanged.

…er in hosted confirm

Activate the owner window, raise it, set focus and process events after the
multiline dialog; use the product paste trigger for the hosted confirmation
branch because modal teardown in the test harness loses focus. The three public
entries remain exercised earlier in the hosted scenario.

Remove the flaky hosted multiline-dialog branch and its debug logs; multiline
cancel/confirm remains covered by the local fake-reader regression. The hosted
real-CF scenario keeps keyboard/menu/Shift+Insert entries and the real
owner-held failure/release path, and reports the skipped multiline scope
explicitly.

Document the three public paste entries, default CF reader, bounded chunked
transfer, target binding, multiline dialog policy, local fake-reader child-byte
regression and the hosted Windows QPA real-CF result (three entries plus real
owner-held failure/release). State that hosted multiline confirmation and
second-session switch/close reuse remain outside the verified scope.

Co-authored-by: JavaZeroo <71128095+JavaZeroo@users.noreply.github.com>

…erage

Keep the failed hosted multiline attempts as history instead of deleting them:
record the first failure, the focus/trigger fix and its failed retry, the
diagnostic-only head, and the recovery-budget conclusion. Add the offline
diagnostic hypotheses and the one-retry minimal plan without claiming a pass.

Also document the local isolation coverage added with the initiation-time target
binding fix: focus switch, close during read, and a new session receiving no old
paste bytes.

QMessageBox::exec() returns the clicked standard button value, not a
QDialog::DialogCode (measured: accept=2, escape=3 on the pinned Qt 6.10.3).
Comparing it against QDialog::Accepted made every confirmed multiline paste
record as cancelled with no transfer, which is the hosted failure fingerprint.

Classify the real user choice via clickedButton() and its AcceptRole instead.
The temporary PASTE_* stderr traces around this path serve the single
authorized hosted recovery run and are removed after it.

Co-authored-by: JavaZeroo <71128095+JavaZeroo@users.noreply.github.com>

Bring the hosted real-CF multiline branch back behind a test-only
TERMFORGE_QT_HOSTED_MULTILINE gate so the default qt-cpp.yml lane keeps its
historical single-line scope while the new branch-scoped recovery workflow
executes the multiline dialog path exactly once per enabling push.

The dialog helper now selects buttons by QMessageBox role with full stderr
logging (box source, every button text/role, match basis, click delivery, and
bounded not-found reporting), so a rejected dialog is attributed instead of
silently read as a user cancellation. The confirm action uses the real Paste
menu entry; the cancel action keeps the real Ctrl+Shift+V entry; the default
product CF reader and the real QMessageBox stay in place. Locally, qt_paste
confirms through the real dialog with a role-selected Paste click and drops
the auto-confirm shortcut; cancel zero-byte and confirm-CR-once assertions
are unchanged and strengthened with a Pasted notice check.

Co-authored-by: JavaZeroo <71128095+JavaZeroo@users.noreply.github.com>

Separate facts from hypotheses in the attempt ledger: the offline probe and
the strengthened local run prove QMessageBox::exec() never returned
QDialog::Accepted, which fully explains the historical hosted failures. Add
the pre-written bounded action plan for the single authorized recovery run
(stop on first failure, no diagnostic copies, unique run/job recorded), the
dialog probe source as evidence, and refresh the README and validation
identity to keep local fake-reader success and hosted real-CF status listed
separately. Attempt 3 stays unclosed until its hosted run is recorded.

Co-authored-by: JavaZeroo <71128095+JavaZeroo@users.noreply.github.com>

Record attempt 3 results in the ledger, README and validation identity:
the single authorized opt-in run 43101420107 / job 130793595825 passed with
multiline_cancel/multiline_confirm true and hosted-real-cf scope, cancel
zero bytes, confirm CRLF-to-CR exactly once, occupied failure and release
success, and zero active owned processes. Remove the temporary PASTE_*
stderr traces from the product path and make the recovery workflow
dispatch-only so no later push can re-execute the real hosted path. Local
offscreen regression re-verified at this head (qt_paste 1/1).

Co-authored-by: JavaZeroo <71128095+JavaZeroo@users.noreply.github.com>