Guard the @-mention lookup against a disposed shell

[TheGreatAxios]

Summary

• Check shell.disposed right after each await in openAtMentionSuggestions and in attachClipboardImage — the only two continuations in shell.ts that resume after an await and then unconditionally write into shell/renderable state — and bail out before any further mutation
• Add regression tests that dispose the shell while each lookup is pending and assert the continuation does not run its post-await writes

Verification

• shell.ts has exactly three await sites: two in openAtMentionSuggestions, one in attachClipboardImage. All three now check shell.disposed before touching shell state or renderables.
• Both new tests fail without the corresponding guard (verified by reverting each fix locally and re-running) and pass with it.
• Caveat: these are headless assertions on return values and shell fields (resolves.toBe(false), overlayKind, pendingAttachments). They show the guarded code path is not reached after dispose, which is strong evidence the writes are prevented — but they do not exercise real native TextBuffer/renderer memory, so they cannot themselves prove the underlying use-after-free/segfault is impossible. Confidence in the fix rests on the code guard (check-before-mutate at every resume point), not on the test alone.
• bun run typecheck and bun run build pass.
• bun test: 4314 pass, 1 pre-existing failure unrelated to this change (tests/integration/reactor-permission-multi-turn.test.ts, plus two markdown-rows.test.ts cases in a full run) — reproduces identically on this branch with the fix stashed out, so it predates this work.

Closes CL-5554

[linear-code]

CL-5554