#14786 Fix TextBox IME replacement range crash

Revives #5346 (closed as stale in the 09-23 bulk close)

What / why

TextBoxInputTextView still forwards the IME's raw replacementRange to NSTextView.insertText / setMarkedText. When an IME hands back a stale range past the end of the UTF-16 storage (seen with Japanese input at the end of the text), AppKit raises NSRangeException (Sentry CMUXTERM-MACOS-VD0). This clamps the replacement range to the storage bounds, and normalizes an NSNotFound marked-text selection to the end of the marked text.

Changes vs the original

• Same fix, ported onto the current insertText override (which now also tracks nested didChangeText). The sanitized range is also what queueAutomaticAttachmentFileCleanup sees.
• Same two regression tests in cmuxTests/TextBoxMentionCompletionTests.swift.

Testing

• CI (cmuxTests TextBoxMentionCompletionTests).

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Fixes a crash in TextBoxInputTextView (Sentry CMUXTERM-MACOS-VD0) where an IME can return a stale replacementRange past the end of the UTF-16 text storage, raising NSRangeException in AppKit. insertText and setMarkedText now clamp the range to the storage bounds, and an NSNotFound marked-text selection is normalized to the end of the marked text.

• Adds two regression tests in cmuxTests/TextBoxMentionCompletionTests.swift for the UTF-16-end clamp and the selection normalization.
• Revives PR #5346 with the same fix ported onto the current code.