Round-seven fixes: swap name room for .tmp; input and notice details

- The shortened fallback swap name was capped at exactly NAME_MAX, so
  compaction's '<journal>.tmp' failed with ENAMETOOLONG on every
  checkpoint and the journal grew by a full copy of the buffer each
  time. Cap it at NAME_MAX - 4.
- A lone UTF-8 lead byte (8-bit Meta terminals) waited a second for
  continuation bytes on every key; wait 250 ms. An invalid byte now ends
  a pending ESC/C-k prefix instead of leaving it for the next key.
- Journal notices are shown after a deferred open's own status (which
  used to overwrite them), all pending ones at once, and the lock-out
  notice is not repeated after every save while the lock is still held.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015rcVQiiWyTzoNrsvLSaAfB

docs/audits/claude-findings-20260923.md

@@ -459,7 +459,9 @@ before the fix (unless noted).
   failed, silently had no or partial crash recovery. The status line now
   says so (once per failure).
 - Basenames over about 233 bytes produced a swap name over NAME_MAX, so
-  such files were never journaled.
+  such files were never journaled. (The first fix capped the name at
+  exactly 255 bytes, which broke compaction's ".tmp" sibling and let
+  the journal grow without bound; it now leaves room for it.)
 
 **Known limitations (not fixed)**
 - Catastrophic regex backtracking (e.g. `(a*)*b`) can still take very