fix(newos4): four-model review — lazy-load race, restore order, a11y, key handling

Reviewed the shipped change set with kimi-k2.7-code, deepseek-v4-pro, glm-5.3 and minimax-m3.
Findings below are the ones that survived verification against file:line; the rest are in
.hermes/plans/2026-11-07_163420-newos4-six-ui-modes.review-log.md

Accepted and fixed:
- apply() had no generation token: a lazy mode load that finished after the user switched to
  another mode force-applied the abandoned one (`apply(want,{force:true})` in the .then).
  Every apply() now bumps `_loadSeq` and the callback acts only while its token is newest.
  Same token also removes a double mount: registerMode() already applies the mode as it
  registers, so the callback was mounting every lazy mode twice (teardown+cleanup twice).
- _restoreStock() used the recorded `nextSibling` as insert anchor. Every real mode moves
  SEVERAL stock nodes (terminal, input, status bar), so the recorded sibling is inside the
  mode container and every insert fell through to append. Now anchors on the next stock node
  that is already back home. A raw child index also fails (elements removed shift the
  indices) — measured order terminal,input,status-bar,quick-actions.
- _abortToClassic() left the broken mode persisted and `_pending` set, so the next reload
  retried the same failure with no way out. It now clears both and stores 'classic'.
- ?ui= reached classList.add('wx11-ui-' + id) unvalidated: a space or colon throws a
  DOMException and boot dies. Validated against /^[a-z][a-z0-9-]{0,15}$/ and no longer
  persisted (the comment always claimed it was a request, not a preference).
- Modes hide .prompt-label, so #command-input had no accessible name at all. The shell sets
  aria-label once when a mode reparents it.
- cockpit: preventDefault on all F1-F8 killed help, the address bar and devtools. F1/F12 are
  left to the browser and nothing is swallowed when focus is in a text field.
- commander: Ctrl/Cmd+K opened the palette even while typing in the composer. Ignored from
  inside editable elements now.
- picker: role=dialog + aria-modal + aria-labelledby + focus on the first card.
- api.capture(): strip the quoting characters from argv (capturePipeOutput takes argv).
- stale `wx11-ui-*` body class removed on switch instead of accumulating.

Rejected with evidence:
- "loadModuleFromURL may not return a boolean" — modules/core/module-manager.js:56 returns
  true on success and :60 false in the catch. Verified by reading the function.
- "_abortToClassic does not clear _pending" — it did not; that one is accepted above. The
  sibling claim that it "leaves the broken mode persisted" was verified by reading the
  function: it never touched localStorage, so also accepted.
- "mm.LATEST_VER / webx11_cache_ver are never set, so the mode URL falls back to ?v=0" —
  modules/core/module-loader.js:12 sets window.webx11.moduleManager.LATEST_VER and :14-15
  writes webx11_cache_ver. Verified live: the mode fetch carries ?v=v4.6.152.
- "moduleManager.modules may be a Map" — it is a plain object (terminal.moduleManager.modules
  .CryptoGzipModule is the documented access path), so ui-commander's Object.keys works.

Verified: node modules/test/test-ui-shell.js -> 25/25 (the test now moves TWO stock nodes; a
raw-index restore fails it with "terminal-container,input-area,status-bar,quick-actions");
probe-ui-modes.py --cycle against production -> ALL PASS, 13 checks.

0 files changed, 0 insertions, 0 deletions