fix(afk): confirm herdr supervisor-pane submit for claude composer

[atqamz]

Summary

• The /afk supervise daemon on a herdr backend redelivered an already-handled escalation into the supervisor pane every cycle. Root cause: blocked is the one pre-Enter agent status that both clears the daemon's pre-type busy guard (classify_agent_status: blocked->idle) and reads submit-active (classify_submit_agent_status: blocked->busy), so a blocked baseline (a supervisor pane parked on a tool/permission prompt) routed submit-confirmation to the composer-clear fallback, and fm_backend_herdr_composer_state returns unknown on a claude dialog screen with no composer row - so a landed submit read as unconfirmed and got retyped forever.
• Fix at the shared herdr adapter (not papered over in the daemon): fm_backend_herdr_send_text_submit branches on the raw pre-Enter status; a blocked baseline confirms via native agent-state on a blocked->working transition only (new working-only mode of fm_backend_herdr_wait_for_working), never composer content - consistent with the 2026-07-07 native-agent-state approach. idle/done and working/unreadable baselines are unchanged.
• Rode along (pipeline auto-fixes for pre-existing NixOS breakage that blocked the suite): a shared fm_test_base_path() test helper for restricted-PATH tests, "$BASH" in the herdr/zellij version-check tests, and an orca.sh JSON.parse guard that exits cleanly on bad stdin.

Test plan

• Regression: reverted the fix -> not ok ... got 'unknown' (the exact misclassification); restored -> both new tests pass. Added to tests/fm-backend-herdr.test.sh: a blocked->working baseline confirms empty and never calls pane read; a stays-blocked baseline reads pending so the buffer is preserved (no false confirm that would drop the escalation).
• Full herdr suite green (77 ok / 0 not ok); bin/backends/herdr.sh shellcheck-clean.
• Validated end to end through the no-mistakes pipeline (review, test, document, lint all green).