fix(release): the seven findings from the pre-release review of the whole tree

A full review of the release tree found seven things, and four of them were mine.

**The gate was red, and I put it there.** Splitting `confirmed` into `confirmedContext`
and `confirmedSwap` changed the wire field without moving three assertions that check
it: `custom-model-one-shot-launch.test.ts` and two in `custom-model-run-menu-ui.test.ts`
(the swap modal and the context modal, each of which already receives exactly the right
per-question flag). Moved, with the titles.

**Worse, my own tests for the split never ran.** The four cases in
`session-custom-model.test.ts` that exist specifically to pin it call `mockRunning()`,
which was declared inside a sibling `describe`, so they threw a ReferenceError during
setup. The split would have shipped with no passing server-side coverage while the gate
reported the failure as four broken tests rather than as four tests that were never
written. `mockRunning` is hoisted to the outer describe.

**The submit verifier pressed Enter into shell panes.** `#455`'s SubmitVerifier resolved
its composer glyph as `promptGlyph ?? '❯'`, and only claude and codex declare one, so
the other eight modes fell back to claude's `❯`. That is also starship's default shell
prompt, and pure's, and spaceship's, and p10k lean's. On such a shell the line
`❯ npm run build` sits on screen for as long as the command runs, the verifier reads it
as an unsubmitted prompt, and re-presses Enter into the running program's stdin up to
nine times on its 2s..60s schedule. Mostly a stray newline; not harmless against a y/N
prompt, `read -p`, an installer or a pager, where it takes the default. The module's own
fileoverview already stated the rule this broke. Now `?? ''`, which
`promptStillInComposer()` already treats as inert, so the verifier runs only for a CLI
that actually declares a composer.

**My #451 dedent removal left a count behind**: "Two rules keep it honest" introducing
three numbered rules.

The rest is documentation the split outran. `confirmedContext`/`confirmedSwap` appeared
in no doc at all, while `docs/api-reference.md` (the SemVer-covered contract) still told
an integrator to retry with `confirmed: true` for both questions, which is precisely the
thing the split exists to stop. Documented there, in `docs/custom-model-endpoints.md`
and in CLAUDE.md. The custom-model changeset gained the split and the `CLAUDE_CONFIG_DIR`
multi-user consequence, both user-visible and both previously absent, and #454's gained
the one exception to its own claim: a Custom Endpoints launch ignores the Instance count
stepper and always starts one session.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/api-reference.md

@@ -651,9 +651,17 @@ confirmed? } | { clear: true }` applies (or clears) the session's
   for a remote (SSH) or Docker session — both restart their agent
   differently under the hood, and applying to one would report success
   while changing nothing. Two more responses replace the normal
-  `{customModel, restarted}` shape, neither an error — both require
-  retrying the same call with `confirmed: true` to proceed anyway, and
-  neither restarts or creates anything on the first ask:
+  `{customModel, restarted}` shape, neither an error, and neither restarts
+  or creates anything on the first ask. ⚠️ **Each is answered by its OWN
+  flag on the retry, and answering one is not consent to the other**: they
+  are questions about different people, and while they shared a single flag
+  a caller who confirmed the context warning silently agreed to evict
+  another session's model as well. Send `confirmedContext: true` to proceed
+  past the context warning, `confirmedSwap: true` past the swap conflict,
+  and both when both were asked (they accumulate, so the second retry still
+  carries the first answer). The original `confirmed: true` still means
+  BOTH and is still accepted, because it shipped in this feature's
+  HTTP-API-only cut; new callers should send the specific one:
   - `{requiresConfirmation: true, currentlyLoadedModel, affectedSessions}` —
     llama.cpp/llama-swap only runs one model at a time, and switching would
     unload a model another **live session's own selection** is actively
@@ -669,12 +677,14 @@ minSafeContextTokens}` — Claude Code's own fixed per-turn overhead
     `contextLengthVar` (claude only today), so it never fires for another
     harness.
 - `POST /api/v1/quick-start`'s `customModel: { endpointId, modelId,
-confirmed? }` field (alongside its normal `caseName`/`mode`/etc. body)
+confirmed?, confirmedContext?, confirmedSwap? }` field (alongside its
+normal `caseName`/`mode`/etc. body)
   computes the same injection **before** the session exists and launches
   directly on the endpoint — no restart, because there was never a
   native-backend boot to restart away from. Runs the identical checks as
   the dedicated route above (`requiresConfirmation`/`requiresContextWarning`,
-  same shapes, same `confirmed: true` retry), and is refused the same way
+  same shapes, same per-question `confirmedContext`/`confirmedSwap` retry),
+  and is refused the same way
   for a remote or Docker case. This is what the Run-menu picker uses for
   opencode, Codex, Gemini, Pi, Grok, DeepSeek and OMP; Claude still uses the
   dedicated restart route above (its `--resume`-based restart is far less