fix(prompts): make destructive confirms one keystrokeHEADmain

I had to kill an Emacs session today over a prompt I could not answer. A
second agent session held the selected window while "Overwrite hiroshi.m3u?
(yes or no)" waited in another frame, so my keystrokes went to a terminal
and the minibuffer stayed empty. Losing unsaved buffers is a far worse
outcome than a mis-keyed confirm.

So cj/confirm-strong becomes cj/confirm-destructive, and instead of binding
use-short-answers to nil for a typed "yes" it reads a single y or n.

Two things I kept:

- No default. Only y and n answer, so a stray RET or space re-prompts
  rather than confirming a shutdown.
- Pending input is discarded before the read. Without that the change would
  have been a bad trade: read-char-choice reads the input queue, so a key
  typed before the prompt painted would confirm instantly, where the old
  typed-"yes" absorbed it harmlessly.

Worth being honest about what this does not fix. One keystroke does not
make a prompt reachable when focus is elsewhere, and C-g is still the
escape. It lowers the cost of the situation rather than preventing it.

Six call sites: shutdown and reboot, shred, playlist overwrite and delete,
and the two file overwrites.

1 files changed, 1 insertions, 1 deletions

diff --git a/docs/specs/2026-07-06-radio-browser-lookup-spec.org b/docs/specs/2026-07-06-radio-browser-lookup-spec.org
index c65de850..89251418 100644
--- a/docs/specs/2026-07-06-radio-browser-lookup-spec.org
+++ b/docs/specs/2026-07-06-radio-browser-lookup-spec.org
@@ -162,7 +162,7 @@ Add cj/music-radio-search (query -> search -> completing-read multi-select -> wr
 
 * Readiness dimensions
 - Data model & ownership: a station plist (uuid, name, url, codec, bitrate, tags, country, votes, clickcount) derived from the API; the .m3u file is generated and owned by Craig once written. No local cache in v1.
-- Errors, empty states & failure: named user-errors — no server reachable, empty results, cancelled selection, write failure (naming the file). No silent data loss; overwrite reuses the existing cj/confirm-strong prompt from create-radio-station.
+- Errors, empty states & failure: named user-errors — no server reachable, empty results, cancelled selection, write failure (naming the file). No silent data loss; overwrite reuses the existing cj/confirm-destructive prompt from create-radio-station.
 - Security & privacy: no credentials. The only outbound data is the search query and a User-Agent to a public API. No sensitive data logged.
 - Observability: the command messages the server used, the result count, and each file written. Search is one short synchronous call; if it ever feels slow, a "Searching radio-browser…" message covers it.
 - Performance & scale: result sets bounded by an explicit limit (default ~30). One GET per search. No scaling concern.