Verify tmux wake prompt submission

[bradbrok]

Closes #953

Outcome

Wake prompts are no longer considered delivered merely because tmux accepted a paste/Enter command. The sender now requires exact transcript evidence that the turn started, retries only a parked Enter, and advances the wake boundary only after verification.

Root cause and fix

• Attach a wake-only submission receipt and resolve it only from the existing exact prompt matcher: a matching transcript user row or queue enqueue→dequeue.
• Keep on_wake_delivered pending until that receipt is true; an exhausted receipt fails closed and emits explicit verified/unverified telemetry.
• Retry Enter at most twice only while the prompt marker remains visible. Never re-paste the wake body.
• Route every verified-wake paste_text timeout into a one-way exact-receipt/Enter-only/fail-closed verifier. The worker's generic timeout retry explicitly excludes verified wakes, closing the asynchronous set-buffer→paste-buffer TOCTOU where a pre-paste receipt check was insufficient.
• Preserve the receipt contract through the worker's landed-tmux-timeout path, which previously could bypass normal delivery bookkeeping.
• Make receipt timeout boundaries race-safe: a positive exact row arriving during the final pane probe wins; a terminal-False wake cannot late-rematch and resurrect FIFO metadata.
• Scale Claude's paste→Enter settle from 300 ms to a bounded 2,000 ms by payload size (6,207 chars receives 1,851 ms). Codex retains its validated 4,000 ms override.
• Defer fresh-session native /effort ultracode until the receipt-verified wake reaches an idle boundary, avoiding slash-command state immediately before the paste.
• Reserve FIFO metadata synchronously on exact transcript acceptance so a user+Stop turn in the same tailer read cannot outrun bookkeeping.

Regression evidence

Positive control on base 38457b247448380131e5ecbdbc27d9daa1395c67: with no transcript receipt, the old path pasted once, retried Enter zero times, and still fired on_delivered=["delivered"] (false delivery claim).

Replacement exact head 6ceaf20628af11d7d2d13b61ecb75ecfe27d871d:

• A real _TmuxControl command-sequence regression models first paste-buffer success, Enter timeout, retry set-buffer suspension, exact positive receipt, and the forbidden second paste-buffer. It now proves set_buffers=1, pane_pastes=1, receipt true, and one receipt-gated callback.
• A separate regression covers exact acceptance while the initial paste_text is still suspended before returning its timeout and proves one paste.
• Python 3.11: tests/test_tmux_session.py — 378 passed.
• Python 3.12 and 3.13: TestWakeSubmissionVerification — 13 passed per version.
• Ruff, lock check, compileall, and git diff --check clean.

The PR remains draft for independent gauntlet review, replacement exact-head CI, and Barsik's isolated live wake E2E. No deploy or live daemon SQLite access is part of this change.