[CTX-1324] fix(security): triage synchronous input-to-plugin VM dispatch #2213

Priority: P1 | Area: security | Labels: fix,P1,area:security | Milestone: 0.0.24 | RFC: P0-AC-015 / security overview invariant 4 | Task: CTX-1324

Source concern

For an enabled, active plugin with an ordinary valid mounted command binding,
the current application input callback can execute the owning plugin VM before
returning. This is the existing-source Major follow-up S1 from the independent
CTX-1321 review; it is separate from deferred UI vocabulary/style expansion.

At Core 4d1b2596d3b69a54224d18af871f826f1bb6a1c6:

1. crates/bitty-terminal/src/terminal_app.rs:2796 routes a platform event into
   Runtime. Matching band release or bound wheel classification queues a request
   (crates/bitty-runtime/src/runtime/input.rs:934, :1542).
2. The same handle_event invocation drains band clicks at
   terminal_app.rs:2832 and scrolls at :2840.
3. dispatch_band_click / dispatch_band_scroll call
   PluginRuntime::dispatch_command (:1889, :1941), which calls
   vm.call_function synchronously at
   crates/bitty-runtime/src/plugin_runtime/mod.rs:2673.

The inspected application/routing/VM blobs are identical at PR #2211 head
c85f94b0f02e93a9daae5d9b8225742c648e1a10 and PR #2212 head
d23def8f697cb864046fda8de9ba3fbb7082fce6. Those unrelated fixes do not remove
this path. Static keybinding command invocation also reaches the same VM through
the application intercept; a band-only fix cannot claim all-input exclusion.

Shared canonical security at 55f540a8c7236e757b6f4cbf21a4c3ce49e92327 makes
input hot-path exclusion normative through overview invariant 4 and P0-AC-015.
Per-callback budgets, bounded queues and command/host capability checks remain
important controls but do not substitute for this scheduling requirement.

Evidence limits and 0.0.24 assessment

This is source inspection only. No application, plugin callback, hostile probe,
VM, clipboard/display/native operation, build, latency probe or released artifact
was executed or verified. No measured stall, exploit, capability escalation or
exact artifact reachability is claimed. Ordinary host-operation grants remain in
place. No canonical risk status or finding severity is changed here.

P0-AC-015 is not demonstrated and its architecture condition is contradicted by
the inspected valid band-input path. An explicit 0.0.24 release-owner/security
disposition is required before calling that control passed or release-ready.
The historical R-007 Mitigated record does not verify this later path. This issue
does not automatically waive/escalate the finding or authorize release-state,
tag, publication, scheduler, origin DTO or invalidation changes.

Smallest next slice and acceptance

• Independently review the source packet under
  recording/release-input-vm-triage/ (Core CTX-1324).
• Authorize a separate finite regression through the actual application's
  AppHandler::handle_event: a tiny real callback, actual Runtime routing,
  owning-VM entry counters before/after input and a distinct cold pump. Assert
  zero VM entries during input, exactly-once later delivery, valid-command and
  fall-through positive controls, and unchanged consumed-release semantics.
  Existing dispatch-helper tests are insufficient. EventContext currently
  requires a real ActiveEventLoop, so explicitly scope a safe opt-in headless
  context and read-only VM counter accessor; no invalid context or live display.
• Select a conforming bounded cold delivery mechanism with the responsible Core
  owner. Existing band queues/cold tick are possible seams, not an accepted
  scheduling decision. Preserve origin fences, live lifecycle/grant revalidation,
  registered command/schema checks, per-host-operation capabilities, queue and
  payload bounds, attribution, and paired input consumption.
• Coordinate origin identity/DTO/invalidation with CTX-1321 and CTX-1299 / [plugins] Reconcile bounded Lua UI composition API and host parity #2191;
  click/scroll lineage is CTX-0946 and CTX-1190 / [ui] Scroll bindings for mounted plugin UI (on_scroll with step arg) #2008; command invocation lineage
  is CTX-1035 / Generic host-mediated command-invocation path (palette/keybinding to dispatch_command, deny-by-default) #1829; cold overlay pump lineage is [plugins] Composer open scene chrome + input pump #1972 / [ux] Host pump driver for overlay capture input (buffer-arrival) #2007. Do not duplicate
  their ownership or make broader UI expansion a prerequisite for triage.
• Keep the P0 criterion unpassed until its required independent architecture and
  integration evidence is recorded. Have the canonical owner reconcile R-007
  evidence and record the release-control disposition. No mitigation or test is
  implemented by this issue.