The renderer paste lane writes through window.api.pty.write, which never
reaches writeTerminalAgentPrompt, so the main-process agent_prompt_blocked
fence could not see it. Its only gate was DECSET 2004 plus render-quiet --
a signal a TUI drawing its own sign-in dialog satisfies perfectly.
Move the credential detector and its tail-window primitives to src/shared so
both processes run one implementation, read the pane's own xterm buffer
through the same visible-screen projection the main-process probe uses, and
refuse the write when the detector fires. The refusal is reported through the
lane's existing undelivered-prompt surface, so nothing is dropped silently.