Widen the mirror-vs-PTY geometry check beyond bottomAnchor: a mismatched mirror may hand claude a false CLEAN

[pseudoseed]

Split out of #197 on the architect's instruction, because it changes live behaviour for harnesses
that work today and deserves its own review rather than riding along behind an opencode fix.

Background

#197 establishes that a PtySession's mirror is born at defaultSessionOptions() = 80x24 and is
only ever resized by a connected browser client. Measured on a live workspace, real agent
geometry is 60-84 rows; four sessions were sitting at exactly 80x24 in a running system. The
shellper's true geometry is already on the wire in WelcomeMessage.cols/.rows and discarded.

#197 fixes the mirror by adopting that geometry on attach, and adds a fact-based check
comparing the mirror against the PTY's real size. That check is deliberately scoped to
bottomAnchor profiles (opencode only), so claude, codex and agy are provably byte-identical
before and after.

The ask

Consider widening the fact-based mirror-vs-PTY check to every harness.

The builder's argument, which the architect judged stronger than it was pitched:

A mismatched mirror can in principle hand claude a false CLEAN.

That is the dangerous direction. The render gate exists to stop a message being typed into a
screen that is not a verified-empty prompt. Its failure modes are not symmetric:

• False hold — the gate cannot verify a clean prompt that is actually clean. Costs minutes of
  delayed mail. This is the opencode failure opencode builders are not reliably reachable — 4 fixes on our side of the line #195 documents.
• False CLEAN — the gate reports a verified-empty prompt when the real screen is not one.
  Delivers into a live turn, onto a half-typed line, or into a dialog. This is the failure the
  whole subsystem was built to prevent.

A mirror smaller than the real screen shows the gate a subset of what the agent painted. For a
top-anchored composer that subset can plausibly look clean while the real screen is not.

Why it was not done in #197

Correctly, and it should stay that way there. It is a live behaviour change for harnesses that
deliver reliably today: a claude session with a mismatched mirror that delivers now would start
holding. And — the reason it needs its own issue rather than a follow-up line — no fixture would
catch it, so a green render-gate suite is not evidence either way. "Fixtures green" would have
been a misleading proof.

What this issue needs to establish

1. Is a false CLEAN actually reachable for a top-anchored profile under a shorter mirror, or
   only theoretically? Construct it from real captures at a real mismatch (80x24 mirror against a
   110x32 agent is the measured field shape) rather than reasoning about it.
2. If reachable, widen the check and accept the new holds as correct.
3. If not reachable, say so with the evidence and close — "we looked and it cannot happen" is a
   result worth having on record.
4. Whichever way it goes, the check must report which direction it detected. opencode render-gate profile no longer matches: capture current frames, then fix, then guard against drift #197's finding
   was that a rows-clip was reported as no-composer-marker — "my mirror is the wrong height"
   spelled as "this app has no composer". Do not reintroduce that one level up.

Related: #197 (the fix this splits from), #195 (parent), #199.