TUI: answer the refine keys from the queue, not the triage menu

[MJohnson459]

Refine is deliberately not a triage verdict — a proposal that goes through it
is still proposed — so filing it behind the verdict menu put it under a
decision it does not make, and hid it one keypress behind the very menu whose
three bad options it exists to escape. The operator notices a sub-standard body
while reading it in the queue, which is where r and R now answer.

What changed

• r (note-driven) and R (interactive) act on a selected proposal from both
  the cockpit and the tasks browser, via a new refine_selected gated on
  TaskState::Proposed. Anything else is a no-op that says why on the status
  line, matching w and !.
• Refresh moves to ctrl-r, freeing the letter.
• The triage menu keeps its own r/R pair, so a refine decided mid-verdict
  costs no escape. Both paths keep the guard refusing anything but a proposal.
• The key hint line gains r/R refine on a proposal. This is what surfaced the
  whole thing: refine had no hint anywhere, because key_hints is computed per
  screen and the menu that owned the keys is a mode.
• DESIGN.md §6 updated — it specified the triage-menu placement, and now
  carries the reasoning for the move plus the ctrl-r rebind. The two CLI
  error strings that pointed at the triage menu now point at R over a
  proposal.

Note for the reviewer

r is a breaking rebind for anyone with refresh in muscle memory. CHANGELOG.md
is untouched, following the convention of the last six commits, but this is
arguably a Changed entry.

From the cockpit a proposal still needs Enter to fold its project's digest open
before r/R reach it (proposals collapse into a per-project digest,
DESIGN.md §7), so it is two keys there rather than one; the tasks browser,
where proposals are ordinary rows, is the single-keypress case.

Two pre-existing defects were found and deliberately left alone:

1. The note-driven refine spawns a stray agent session literally named
   voro-{task_id} — spawn_expansion (dispatch.rs:500) substitutes only
   PROMPT_FILE_PLACEHOLDER, where the real dispatch path
   (dispatch.rs:884-885) substitutes TASK_ID_PLACEHOLDER too. Underneath
   that, refine() borrows agent.dispatch_command(), whose built-in claude
   template carries --bg --name, so refine launches a backgrounded named
   session at all — contradicting DESIGN.md §6's "it is not a dispatch".
2. key_hints ignores app.mode, so any open modal still shows the underlying
   screen's keys.

Verification

cargo test --workspace 273 passed / 0 failed.
cargo clippy --workspace --all-targets -- -D warnings clean.
cargo fmt --all applied.