`gaia docker` security prompt eats first character of each option label

[itomek]

When gaia docker triggers a path-access security check, the interactive prompt is mangled. Option labels render with the first character missing (Yes / No / Always becomes es / o / lways), and the prompt re-renders mid-execution between the spinner ticks, eating the user's first keypress.

Reproduction

⚠️  SECURITY WARNING: Agent is attempting to access a path outside allowed directories.
   Path: C:\Users\tomas\src\test\t1
   Allowed: ['C:\\Users\\tomas\\src\\amd\\gaia']
Allow this access? es / o / lways:
⠙ Executing analyze_directory
Please answer 'y', 'n', or 'a'.
Allow this access? es / o / lways:
⠦ Executing analyze_directory

Likely cause

Async spinner / progress indicator is racing with the input prompt's stdout writes, and stdin reads are getting clobbered. User had to type quickly to escape.

Fix

Pause the spinner while the prompt is awaiting input. Render the option labels in a single write call. Worth checking other interactive paths for the same race (related to #3's "input handling under async execution" pattern).

Severity rationale

P2 — affects any user hitting a gaia docker security prompt; bypassable with fast typing but visibly broken.

[github-actions]

Confirmed — and there are actually two root causes here, not one.

The prompt string is "Allow this access? [y]es / [n]o / [a]lways: " (src/gaia/security.py:373). The agent's progress indicator wraps stdout in a Rich Live renderer (src/gaia/agents/base/console.py:330), which interprets [y], [n], [a] as Rich markup tags. Unknown style tags get stripped, which is why you see es / o / lways instead of [y]es / [n]o / [a]lways. So the missing-character symptom is markup interpretation, not a partial keypress eat.

The spinner re-rendering at refresh_per_second=10 is the second problem — it redraws over the prompt line every 100ms, which is what makes the prompt reappear between ticks and clobbers stdin.

Fix needs both:

1. Pause the progress indicator around prompt_user_for_path() (the same fix should apply to _prompt_overwrite() at src/gaia/security.py:526 and any other input() paths inside the agent loop).
2. Change the prompt format so it doesn't collide with Rich markup — either escape (\[y\]es / \[n\]o / \[a\]lways) or just switch to parentheses: (y)es / (n)o / (a)lways. Parentheses are friendlier and immune to any future Rich-wrapped renderer.

A grep for input( under src/gaia/ will surface the other interactive paths worth auditing in the same pass — gaia chat, gaia code, and the installer all have similar prompts that may have the same markup-leak risk if they ever run while a Live is active.

P2 sounds right — visibly broken but not data-loss.

cc @kovtcharov-amd for the fix prioritization.