[medium] keymap: prefix-match single-keystroke bindings (batched-read miss)

[fentas]

Split out from #419.

keymap.match (src/keymap.zig ~283) requires a whole-read byte-exact std.mem.eql(input, bind.bytes). When a keystroke is batched with other bytes in one read (fast typing, paste, a mouse burst trailing a keystroke), the binding silently doesn't fire and the raw bytes flow to the shell — latency-sensitive for Right/End ghost-accept.

Fix: prefix-match the single-keystroke action set against the head of input and consume the matched prefix. Needs care to avoid regressions where a binding's bytes are a prefix of a longer distinct sequence; scope to the single-keystroke bindings and verify against the kitty-kbd CSI-u forms. Deferred from #419 (the line_state split-CSI fix landed there) as a separate, higher-risk change.

[fentas]

Investigated for an autonomous fix; deferring and leaving open — a correct prefix-match is both higher-risk than it looks and blocked on a proxy restructure that's already a documented follow-up elsewhere. Concrete blockers:

1. Prefix-of-longer-sequence hazard is severe, not edge-case. Esc (legacy \x1b, one byte) is bound to llm_exec_cancel. It is a strict prefix of essentially every escape sequence the terminal emits:

• legacy nav keys \x1b[C/D/A/B/H/F (Right is itself a ghost-accept binding; Up/Left/Down are unbound and must pass through),
• the Esc+1..Esc+9 ghost-pick fallbacks \x1b1..\x1b9,
• every Alt+<letter> LLM binding (legacy \x1b<letter>),
• every kitty CSI-u form \x1b[...u.

A blanket head-of-input prefix scan would fire llm_exec_cancel on every arrow keypress and forward the orphaned tail ([C, 1, a, …) to the shell as mojibake.

2. A "safe subset" scan needs whole-universe prefix-freedom, not just binding-vs-binding. To prefix-match only the bindings that are safe, the comptime check has to prove a binding's bytes are never a prefix of any sequence the terminal can send — including unbound ones (the arrows above). That's a much stronger property than "no other binding starts with these bytes," and it's brittle against future binding additions.

3. Consuming the matched prefix requires the deferred partial-read restructure. The proxy's stdin path (src/proxy.zig ~900–1300) treats the read as a single input slice: ghost_accept replaces input wholesale with the suggestion bytes, then applyInput / line_state / forward all act on that one slice. Accepting a matched prefix and forwarding the trailing typed bytes (in order, after the injected suggestion) means re-entering the dispatch block per segment. This is the exact partial-consume work the mouse-burst code already defers ("the keymap / line_state path expects to see the full read — partial-burst handling belongs in a follow-up once a consumer surfaces a use case", src/proxy.zig).

Net: the user-visible win is narrow (ghost-accept latency on a rare keystroke-first batched read), while the change touches the hottest path in the proxy with a catastrophic failure mode (Esc-prefix) if the safe-subset analysis is wrong. Better landed alongside the partial-read restructure from the mouse-burst follow-up, with a comptime prefix-freedom assertion guarding the safe-subset. Leaving open as a tracked, lower-priority hot-path item rather than forcing it.