fix(prompts): make destructive confirms one keystrokeHEADmain

I had to kill an Emacs session today over a prompt I could not answer. A
second agent session held the selected window while "Overwrite hiroshi.m3u?
(yes or no)" waited in another frame, so my keystrokes went to a terminal
and the minibuffer stayed empty. Losing unsaved buffers is a far worse
outcome than a mis-keyed confirm.

So cj/confirm-strong becomes cj/confirm-destructive, and instead of binding
use-short-answers to nil for a typed "yes" it reads a single y or n.

Two things I kept:

- No default. Only y and n answer, so a stray RET or space re-prompts
  rather than confirming a shutdown.
- Pending input is discarded before the read. Without that the change would
  have been a bad trade: read-char-choice reads the input queue, so a key
  typed before the prompt painted would confirm instantly, where the old
  typed-"yes" absorbed it harmlessly.

Worth being honest about what this does not fix. One keystroke does not
make a prompt reachable when focus is elsewhere, and C-g is still the
escape. It lowers the cost of the situation rather than preventing it.

Six call sites: shutdown and reboot, shred, playlist overwrite and delete,
and the two file overwrites.

1 files changed, 10 insertions, 4 deletions

diff --git a/tests/test-custom-buffer-file-rename-buffer-and-file.el b/tests/test-custom-buffer-file-rename-buffer-and-file.el
index 1eb61f1b..019fad8c 100644
--- a/tests/test-custom-buffer-file-rename-buffer-and-file.el
+++ b/tests/test-custom-buffer-file-rename-buffer-and-file.el
@@ -923,11 +923,17 @@
         (with-temp-file new-file
           (insert "existing"))
         (find-file old-file)
-        ;; Mock yes-or-no-p to capture that it was called
-        (cl-letf (((symbol-function 'yes-or-no-p)
-                   (lambda (prompt)
+        ;; The overwrite confirm goes through `cj/confirm-destructive', which
+        ;; reads a single key rather than a typed yes.  Mock the key read, not
+        ;; `yes-or-no-p' -- mocking the latter would pass whether or not the
+        ;; prompt happened at all.
+        (cl-letf (((symbol-function 'read-char-choice)
+                   (lambda (&rest _)
                      (setq prompted t)
-                     t))
+                     ?y))
+                  ((symbol-function 'yes-or-no-p)
+                   (lambda (&rest _)
+                     (error "overwrite confirm must not demand a typed yes")))
                   ((symbol-function 'read-string)
                    (lambda (&rest _) "new.txt")))
           (call-interactively #'cj/rename-buffer-and-file)