fix(prompts): make destructive confirms one keystrokeHEADmain

I had to kill an Emacs session today over a prompt I could not answer. A
second agent session held the selected window while "Overwrite hiroshi.m3u?
(yes or no)" waited in another frame, so my keystrokes went to a terminal
and the minibuffer stayed empty. Losing unsaved buffers is a far worse
outcome than a mis-keyed confirm.

So cj/confirm-strong becomes cj/confirm-destructive, and instead of binding
use-short-answers to nil for a typed "yes" it reads a single y or n.

Two things I kept:

- No default. Only y and n answer, so a stray RET or space re-prompts
  rather than confirming a shutdown.
- Pending input is discarded before the read. Without that the change would
  have been a bad trade: read-char-choice reads the input queue, so a key
  typed before the prompt painted would confirm instantly, where the old
  typed-"yes" absorbed it harmlessly.

Worth being honest about what this does not fix. One keystroke does not
make a prompt reachable when focus is elsewhere, and C-g is still the
escape. It lowers the cost of the situation rather than preventing it.

Six call sites: shutdown and reboot, shred, playlist overwrite and delete,
and the two file overwrites.

1 files changed, 3 insertions, 3 deletions

diff --git a/modules/custom-buffer-file.el b/modules/custom-buffer-file.el
index 0ca06cf9..fdcc4d2f 100644
--- a/modules/custom-buffer-file.el
+++ b/modules/custom-buffer-file.el
@@ -59,7 +59,7 @@
 (declare-function mm-insert-part "mm-decode")
 (declare-function mm-destroy-parts "mm-decode")
 (require 'external-open) ;; for cj/xdg-open, cj/open-this-file-with
-(require 'system-lib)   ;; cj/confirm-strong (overwrite confirms), used below
+(require 'system-lib)   ;; cj/confirm-destructive (overwrite confirms), used below
 
 ;; cj/kill-buffer-and-window and cj/kill-other-window-buffer defined in undead-buffers.el
 (declare-function cj/kill-buffer-and-window "undead-buffers")
@@ -168,7 +168,7 @@ When called interactively, prompts for confirmation if target file exists."
     (condition-case _
         (cj/--move-buffer-and-file dir nil)
       (file-already-exists
-       (if (cj/confirm-strong (format "File %s exists; overwrite? " target))
+       (if (cj/confirm-destructive (format "File %s exists; overwrite? " target))
            (cj/--move-buffer-and-file dir t)
          (message "File not moved"))))))
 
@@ -208,7 +208,7 @@ When called interactively, prompts for confirmation if target file exists."
   (condition-case err
       (cj/--rename-buffer-and-file new-name nil)
     (file-already-exists
-     (if (cj/confirm-strong (format "File %s exists; overwrite? " new-name))
+     (if (cj/confirm-destructive (format "File %s exists; overwrite? " new-name))
          (cj/--rename-buffer-and-file new-name t)
        (message "File not renamed")))
     (error