tui3: make the switch and plan test fakes safe for off-loop readers

[ZeroPoint95]

Fixes the pre-existing -race failures in tui3's held-send and plan tests. Every race was in a test fake; production code is unchanged.

What changed

Why it's the fakes, not production

• Each race report has a test fake on one side and an off-loop reader on the other: the keeper watcher calling Attach, or the door line calling the plan reads and verbs.
• Attach is locked in production: session/agent.go holds a.mu, and remote/observe.go holds c.mu.
• The plan methods already build fresh results per call:
  • session/plandb_tasks.go (PlanTasks, PlanTaskPage) opens its own store handles each time and builds a new slice.
  • session/plandb_steer.go (the verbs) writes the store, not anything the surface holds.
  • remote/client.go is RPC that unmarshals a fresh value per call, so it needs no lock.

Changes (test files only, plus the change entry)

• switchAgent: a mutex guards running/backlog/stops for Attach and its stop. Tests that flip running once a watcher may be live use setRunning.
• planFake:
  • PlanTasks returns a copy.
  • setStatus writes a new slice instead of the one planAppWith gave the surface.
  • plan and pages are locked, and test writes go through setPage / editRows / setPlan.
• railPlanCounter: the rows/pages counters are atomic.

Tests fixed

• TestAFailedHeldSendStaysWaitingWithItsAttachmentsAndNotesTheFailure
• TestAWaitingPictureSendsInItsHeldConversationAndTheWatcherAdoptsItsTurn
• TestComingBackDuringAHeldSendNeverSendsItTwice
• TestHeldWaitingMessagesGoOnePerLandingAfterSessionFollowUpsAndNeverTwice
• TestStopOnTheRunsOwnPageRaisesTheCardAndTheCardStopsTheRun
• Same class, also red on dev:
  • TestAProgramRoomReadsTheLandingTheStoreEndedAhead
  • TestTheCancelKeyOnAPlanRowEndsItThroughTheStore
  • TestPOnAPlanRowPausesThenResumes

How it was checked

1. dev (6c65989), the 10 tests by exact name, go test -race -count=1
   • Printed FAIL for the 8 above, with 10 WARNING: DATA RACE reports.
   • The other 2 are siblings matched by the same patterns, and they pass on dev too: TestHeldWaitingMessagesUsePasteAndRemoteFileDoors and TestAHeldWaitingChatTitleRedrawsWithoutAnotherAttentionNotice.
2. This head (merged with that dev), the same 10, -race -count=5
   • Printed --- PASS 5/5 for all 10 and ok internal/tui3, with 0 DATA RACE reports.
3. Broad run: every test in a file that uses these fakes or that this PR touches, 496 tests, -race -count=1
   • Printed 496 PASS, 0 FAIL and 0 DATA RACE.
4. make changelog-check
   • Printed 11 entries, all well formed.
5. Repro:
   • GOFLAGS=-mod=readonly go test -race -count=5 -run 'HeldSend|HeldWaiting|WaitingPicture|ComingBackDuringAHeldSend|TestStopOnTheRunsOwnPage|TestAProgramRoomReadsTheLanding|TestTheCancelKeyOnAPlanRow|TestPOnAPlanRow' ./internal/tui3/

Checklist

• A change entry: docs/changes/unreleased/1836-held-send-race-fakes.md (kind: internal).
• The manual knows about it: not needed, since no command, key, tool, default, limit or refusal moved.
• No new line in .github/known-red.txt: none added (the file doesn't exist on dev).
• Only my own paths are staged: each file added by name, no git add -A.

🤖 Generated with Claude Code