Confirm every write Orchestra sends, and count none of them as progress

F20. Only the launch confirmed its submit. A decision notice at a turn
boundary, and /clear or @HANDOFF.md during a context reset, were
fire-and-forget through the same transport that loses an Enter often enough
that the launch needed three resubmits. A lost Enter on the context-reset path
is the worst of them: it strands the session mid-rollover and nothing retries
it. LaunchConfirmer is therefore InputConfirmer, ConfirmLaunch is ConfirmInput,
and sendPrompt and sendLine both go through it.

Orchestra does not try to guarantee delivery of input it did not originate.
But it must never read that input as work, which is the F16 half. Burn-in run
3 stalled with an unexplained "go ahead and implement it" in the editor, and
the renewal check hashed the whole capture, so those keystrokes read as
progress and the lease kept renewing around an idle agent. PaneProgress drops
input lines from the capture, which the -J join makes exact: a wrapped input
block is one line beginning with the prompt marker.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

internal/herdr/backend.go

@@ -113,12 +113,25 @@ type LaunchTransporter interface {
 // uncertain one: the lease must be released and retried rather than held.
 var ErrPromptNotSubmitted = errors.New("prompt_not_submitted")
 
-// LaunchConfirmer is optional. A backend that does not implement it treats a
+// InputConfirmer is optional. A backend that does not implement it treats a
 // successful Prompt as proof of submission, which is only sound where the
 // backend's own protocol acknowledges the prompt.
 //
-// ConfirmLaunch returns the evidence that convinced it, or an error wrapping
+// Every write Orchestra originates goes through this, not only the launch: a
+// lost Enter on a phase continuation or a context reset strands the session
+// exactly as a lost launch does, and burn-in run 3 showed the Enter is lost
+// often enough to matter.
+//
+// ConfirmInput returns the evidence that convinced it, or an error wrapping
 // ErrPromptNotSubmitted when the submission cannot be observed.
-type LaunchConfirmer interface {
-	ConfirmLaunch(ctx context.Context, s Session, submitted string) (string, error)
+type InputConfirmer interface {
+	ConfirmInput(ctx context.Context, s Session, submitted string) (string, error)
+}
+
+// PaneProgress is optional. It reports pane content with harness input lines
+// removed, so that typing into a pane is not mistaken for the agent doing
+// work. Orchestra does not guarantee delivery of input it did not originate,
+// but it must never count that input as progress.
+type PaneProgress interface {
+	PaneProgress(ctx context.Context, s Session) (string, error)
 }