test(paste): pin the main pane's keydown hand-off, and say which engines still get two pastes (#799)

The two edits promised in the review of #799:

- The main pane's Ctrl+V branch hands the keydown to the paste trap, and
  nothing tested that call: with it reverted to `_handleImagePaste()` every
  test still passed and Firefox would paste twice again. A source pin now
  fails on that, like the Ctrl+C one in terminal-copy-clean.test.ts.
- architecture-invariants and src/web/CLAUDE.md described the key's own paste
  as reaching the trap in every browser. Since #799 that is Chromium and
  WebKit only: in Firefox the trap cancels the keydown.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>

test/image-paste-trap.test.ts

@@ -455,6 +455,22 @@ describe('Ctrl+V paste trap', () => {
 
     expect(h.inputted).toEqual(['\x1b[200~hello world\x1b[201~']);
   });
+
+  it('is handed the keydown by the main pane, pinned at the source', () => {
+    // The Ctrl+V branch lives inside initTerminal's attachCustomKeyEventHandler
+    // closure, over a real xterm this harness cannot build, so the call is pinned
+    // at the source, like the Ctrl+C rule in terminal-copy-clean.test.ts. A tile's
+    // call is driven for real in terminal-tile-input.test.ts. Without the keydown
+    // the trap cannot cancel it, and Firefox pastes twice again.
+    const terminalUi = readFileSync(resolve(import.meta.dirname, '../src/web/public/terminal-ui.js'), 'utf8');
+    const start = terminalUi.indexOf('// Ctrl+V / Cmd+V: intercept before xterm sends ^V to PTY.');
+    expect(start).toBeGreaterThan(-1);
+    const end = terminalUi.indexOf('// Ctrl+Z (SIGTSTP/job-control suspend)', start);
+    expect(end).toBeGreaterThan(start);
+    const branch = terminalUi.slice(start, end);
+    expect(branch).toContain('this._handleImagePaste({ keyEvent: ev });');
+    expect(branch).not.toContain('this._handleImagePaste()');
+  });
 });
 
 describe('image upload insertion policy', () => {