fix(agent-isolation): stop the macOS touch overlay deadlocking on SIGTERM

[potiuk]

The macOS touch overlay sometimes hangs on screen after the key is touched, and only a force-quit gets rid of it.

Cause

The watcher closes the Aqua window with SIGTERM. The window script installs flag-setting Python handlers for that, but it does so before tk.Tk(). Aqua Tk's initialisation then replaces SIGINT/SIGHUP/SIGTERM with its own TkMacOSXSignalHandler, which calls Tcl_Exit straight from signal context.

That is not async-signal-safe. The pulse redraws every 33 ms, so the signal often lands mid-draw, inside CA::Transaction::commit, which holds CoreAnimation's backing-store lock. Tcl_Exit destroys the windows, the destroy invalidates the view, and that blocks on the same lock. The main thread deadlocks on itself.

A macOS hang report shows exactly that chain:

CA::Transaction::commit → … → ripc_DrawRects
  → _sigtramp → TkMacOSXSignalHandler → Tcl_Exit
  → Tk_DestroyWindow → XDestroyWindow → -[NSView setNeedsDisplayInRect:]
  → CABackingStoreInvalidate → __psynch_mutexwait   (deadlocked, 14 s+)

Fix

• New take_back_signals() installs the flag handlers for SIGTERM, SIGINT and SIGHUP right after the root exists, so Tk's handler is replaced. The existing watch_for_stop poll then closes the window, and nothing unsafe runs in signal context.
• main() no longer installs handlers before tk.Tk().
• New AST test test_the_aqua_window_takes_termination_signals_back_from_tk pins the ordering. It fails on the old code.

Testing

• tools/agent-isolation/tests/test_gpg_touch_overlay.py: 93 passed, 7 skipped (the environment has no Tk 8.6 python, and ps is restricted).
• The pre-commit hooks pass: workspace ruff, ruff format, mypy and pytest.
• Not reproduced live: the deadlock is a timing race, and the hang report above is the evidence.

🤖 Generated with Claude Code