#14921 Pin password badge actions to their source runtime

Follow-up to #14867 and #14905 (password input indicator).

• Runtime guard: the GHOSTTY_ACTION_SECURE_INPUT handler only checked the TerminalSurface model, which outlives hibernation and stale-runtime release. An ON action queued by a released runtime could re-show the badge after terminalSurfaceRuntimeDidRelease() cleared it. The main-thread hop now also requires the model's current runtime surface to be the one the action came from.
• Docs parity: the local-prompt, live-apply, and pasted-text notes from all-keys.md are now in the cmux.schema.json descriptions (embedded schema regenerated) and in the Settings subtitles in all 9 locales.
• Release notification: the pane host is notified of a runtime release only when a runtime was actually released.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Fixes a race where a password badge ON action queued by a released runtime could re-show the badge after teardown cleared it. The main-thread hop now only runs if the action's callback context is still the terminal's active runtime context.

• Compares the per-runtime callback context (captured weakly) rather than the native surface pointer, which a replacement runtime may reuse.
• Adds local-prompt and pasted-text notes to the schema descriptions and Settings subtitles in all 9 locales, noting changes apply to already-open prompts.
• Notifies the pane host of a runtime release only when a runtime was actually released.

Summary by CodeRabbit

• Updates

  • Clarified that password-prompt detection applies to local prompts, including an SSH client’s own password prompt, but not sudo prompts inside an SSH session.
  • Clarified that password dots count typed characters, not pasted text, and that only the count—not the characters—is retained.
  • Changes to the password indicator setting now apply to prompts that are already open.

• Bug Fixes

  • Improved password-indicator updates when a terminal surface changes, preventing updates from being applied to a surface that is no longer current.