fix: regenerate screenshots, and two bugs they exposed

[404SecNotFound]

All four README screenshots showed the 11-technique catalog. Regenerated against the current 24-technique build.

Capturing them surfaced two real bugs, both fixed here with tests.

Bug 1: the menu key legend lied

replicant menu printed a hardcoded [1-11] technique while the catalog held 24. The selection validator directly below it has always bounded on len(catalog.techniques), so the hint contradicted the code and told operators that techniques 12-24 could not be selected.

Now derived, and extracted as _key_hint() so a test can pin it to the catalog size.

Bug 2: the embedded terminal corrupted box-drawing characters

pty_bridge decoded every os.read chunk independently:

await websocket.send_text(data.decode("utf-8", "replace"))

os.read returns whatever bytes are ready, so a chunk boundary can land mid-UTF-8-sequence. With errors="replace" those split bytes become U+FFFD permanently. Box-drawing glyphs are 3 bytes each, so the bigger menu table made a straddled boundary likely, and the table border rendered corrupted:

└─────┴─────────┴────────────────��──────────┴─────────┘

Fixed with a single incremental decoder per connection that holds an incomplete tail until the rest of the sequence arrives.

Verified end to end, not just in unit tests. Reading the live xterm buffer back over CDP showed U+FFFD inside the border before the fix and a clean border after it. This is a user-facing rendering bug in the product, not just a screenshot problem: any sufficiently large terminal output could hit it.

How the screenshots were produced

Driving the real commands and the real UI, so they cannot drift from behavior:

Image	How
cli-list.png	Rich export_svg of the actual cmd_list output, rendered to PNG via headless Chrome. Console width 100 to 110 columns, which removes most of the row wrapping 24 entries would otherwise cause
webui-emitter.png	Emitter tab, REP-001 selected
webui-run.png	REP-004 mid-run
webui-terminal.png	Terminal tab, menu listing all 24

One detail worth noting on webui-run.png: with both destination toggles off the run is a dry-run that finishes in ~3s at 43k eps, which is unrepresentative and visibly contradicts the cap 2000 readout beside it. The capture now enables the collector destination, so the run is rate-limited and the waveform matches what an operator actually sees (1818 eps, mid-run).

Verification

443 tests pass, up from 438. The decoder tests assert every possible split point of a border string round-trips, and pin the old naive behavior so the regression cannot return quietly. ruff, black, mypy clean.

Note

cli-list.png is now 1440x1095 rather than 1440x810: 24 rows is simply taller than 11. The other three keep their original dimensions.