fix(pty): make the foreground-handoff grace a config field

The local PTY readiness poll held its inferred_idle fallback for exactly
one pollIntervalMs after a prompt marker, so a bash foreground handoff
that lands on the silence boundary only wins the exact stdin_read
attribution when the kernel publishes it inside that single poll. On a
slow or loaded host it does not, and the attribution flips.

handoffGraceMs replaces the hardcoded one-poll window as a validated,
deployment-owned config field defaulting to 500ms, rejected at load when
it cannot contain one readiness poll. Real-shell tests that interrupt a
send now assert the session is usable again rather than which readiness
tier observed the handoff, because no fixed grace removes the race.

examples/acp-agent/pty.cordis.yml

@@ -14,6 +14,7 @@
               pollIntervalMs: 10
               exactProbeAfterMs: 20
               idleSilenceMs: 250
+              handoffGraceMs: 250
               timeoutMs: 2000
               disposeGraceMs: 500
           - id: tool-pty