fix(spec): wait for inner zsh ready and use portable mktemp

Two macOS-specific regressions in the new zpty-based mock:

- `mktemp -p /var/tmp …` is GNU-only. BSD `mktemp` (macOS) treats `-p`
  as the prefix flag, so the inner script either pointed at a stale
  path or was empty. Build the path explicitly under TMPDIR (or /tmp)
  and `:>` it instead, which both shells honor.

- `zpty mock 'zsh -fi -c …'` returns immediately, but ZLE inside the
  inner shell isn't ready until later. macOS pty buffering let the
  TAB land before `bindkey` had taken effect, so `vared` sat there
  forever. Have the inner shell print a `\C-E` sentinel right before
  `vared`, and gate `zpty -w` on receiving it. The marker uses a
  trailing newline because the inner shell's stdout is line-buffered.

Also pass `-f` alongside `-i` so the inner shell skips user rcfiles
and starts up faster.

Author: claude

src/tabular/shell/zsh.ecr

@@ -5,18 +5,26 @@
 #   glibc-based zsh 5.9 builds (Ubuntu 24.04, Debian sid, recent Homebrew)
 #   that combination corrupts the heap and the pty emits `free(): invalid
 #   pointer` instead of any completions. Spawning a fresh interactive
-#   `zsh -i -c 'source <file>'` inside the zpty gives ZLE its own session and
+#   `zsh -fi -c 'source <file>'` inside the zpty gives ZLE its own session and
 #   sidesteps the crash. We also avoid an EXIT trap on the outer shell — zpty
 #   propagates inherited traps to the child, so an outer cleanup trap would
 #   delete the source file out from under the next iteration.
+#
+#   The inner shell prints a READY sentinel right before `vared` activates, so
+#   the outer shell waits for it before sending input. Without that handshake,
+#   macOS pty buffering races with `zpty -w` and the TAB lands before ZLE has
+#   bound it, hanging on `vared` forever.
 autoload -U compinit
 compinit -u
 
 <% completers.each do |comp| -%>
 eval "$(<%= comp %> completion <%= bin %>)"
 <% end %>
 
-INNER=$(mktemp -p /var/tmp tabular_<%= pty %>.XXXXXX) || exit 1
+# `mktemp -p` is GNU-only; BSD `mktemp` (macOS) treats `-p` as the prefix flag.
+# Use an explicit path under TMPDIR (or /tmp) instead, which both honor.
+INNER="${TMPDIR:-/tmp}/tabular_<%= pty %>.$$"
+: > "${INNER}" || exit 1
 {
 	print -r -- 'autoload -U compinit'
 	print -r -- 'compinit -u'
@@ -25,6 +33,7 @@ INNER=$(mktemp -p /var/tmp tabular_<%= pty %>.XXXXXX) || exit 1
 <% end -%>
 	print -r -- 'D_OPN=$'\''\C-B'\'
 	print -r -- 'D_CLS=$'\''\C-C'\'
+	print -r -- 'D_RDY=$'\''\C-E'\'
 	print -r -- 'zstyle ":completion:*" max-matches-width 10'
 	print -r -- 'zstyle ":completion:*" list-colors ""'
 	print -r -- 'zle -C {,,}complete-word'
@@ -41,16 +50,26 @@ INNER=$(mktemp -p /var/tmp tabular_<%= pty %>.XXXXXX) || exit 1
 	print -r -- '  exit'
 	print -r -- '}'
 	print -r -- 'bindkey "^I" complete-word'
+	# Trailing newline is required: pty stdout is line-buffered, so a bare
+	# `\C-E` would sit in the inner shell's buffer and the outer would block.
+	print -r -- 'print -- "${D_RDY}"'
 	print -r -- 'vared -c tmp'
 } > "${INNER}"
 
 D_OPN=$'\C-B'
 D_CLS=$'\C-C'
+D_RDY=$'\C-E'
 
 zmodload zsh/zpty
 
 while read -r -t10 -A ARGS; do
-	zpty <%= pty %> "zsh -i -c 'source ${INNER}'"
+	zpty <%= pty %> "zsh -fi -c 'source ${INNER}'"
+
+	# Wait until the inner shell has bound TAB and is parked in `vared`.
+	while zpty -r <%= pty %> REPLY; do
+		[[ "${REPLY}" == *"${D_RDY}"* ]] && break
+	done
+
 	zpty -w -n <%= pty %> "<%= prog %> ${ARGS[*]}"$'\t'
 
 	PTY_LINES=()