#29871 base red: NativePopupHost's menu-tracking observers bind the menu nonisolated(unsafe) before assumeIsolated

Base red, and it hides signal: cmux-ci compile-check --app fails at base db634370b9b615e5f02db154a56295b430675605 in CmuxNextDesign, so nothing downstream compiles:

Packages/macOS/CmuxNext/Sources/CmuxNextDesign/Overlay/NativePopupHost.swift:235:46: error: sending 'menu' risks causing data races [#SendingRisksDataRace]
Packages/macOS/CmuxNext/Sources/CmuxNextDesign/Overlay/NativePopupHost.swift:239:46: error: sending 'menu' risks causing data races [#SendingRisksDataRace]

#28704 (a8502bea464) added the NSMenu.didBegin/didEndTrackingNotification observers, which pass the notification's NSMenu into MainActor.assumeIsolated. The menu is read only inside that call, on its own main-thread delivery (the guard returns when off the main thread). So it is bound nonisolated(unsafe), the idiom MainActorObservation already uses for its note, with a crash-allow: reason. No behaviour change.

Risk: none at runtime. This is a 2-site isolation annotation.

Agent session: agent session

🤖 Generated with Claude Code