Guard destructive settings and radio actions

- Route reset campaign and tutorial replay through one reusable confirmation dialog; repeated presses cannot stack or emit twice.
- Keep emergency hold-to-send single-shot and cover the post-submit release.
- Add destructive-action regression checks, strings and documentation.

TODO.md

@@ -7,7 +7,7 @@ see `AGENTS.md` for the workflow and `MEMORY.md` for the decisions behind these
 
 Baseline: **v0.9.2** (2026-11-02). Three playable venues, tutorial/campaign/checkpoint resume,
 difficulty/help, audio/accessibility settings, a 24-NPC budget baseline, a complete
-escalation/access/radio loop, shift review, the Blender asset library, 260 headless + 97 Python
+escalation/access/radio loop, shift review, the Blender asset library, 261 headless + 97 Python
 tests, a clean screen-design judge and an optional Forward+ Desktop HQ build. This is a strong
 release-candidate foundation, not yet a 0.10.0 release candidate.
 
@@ -94,8 +94,10 @@ screen-design judge before any model/texture changes. No gameplay rules change.
       strings; fix clipping, overflow and overlapping layouts. (Target chip now
       measures/caps scaled text, HUD top labels clip, and action buttons ellipsize;
       regression checks are in `test_accessibility.gd` and `test_ui_buttons.gd`.)
-- [ ] Test destructive/irreversible actions (campaign reset, tutorial replay,
+- [x] Test destructive/irreversible actions (campaign reset, tutorial replay,
       emergency send) require the intended confirmation/hold and cannot double-fire.
+      (Reset/replay share one guarded confirmation dialog; emergency hold submits
+      once and ignores the post-submit release. Covered by session/radio tests.)
 - [ ] Verify radio normal-send vs emergency hold, inspection/wand allow/deny,
       review continue/retry/menu and Help search/filter behavior end to end.