Fix drag-out giving live drags to OLE: prove the pointer left REAPER

OffReaper leaves the surface vocabulary; OsHandoff now gates on a window-ownership
proof resolved in the shell, so no in-REAPER surface can reach DoDragDrop.

src/core/ui/drag_out.cpp

@@ -24,10 +24,12 @@ DropClass decideDropClass(int px, int py, const PanelClientRect& client,
     if (!ctx.drag.dragging || !ctx.drag.hasArmedSamples) return DropClass::None;
     if (insideClient(px, py, client)) return DropClass::Internal;
 
-    switch (ctx.surface) {
-        case ReaperSurface::OffReaper:
-            return DropClass::OsHandoff;
+    // The hand-off gate sits AHEAD of the surface switch and is the only route to OsHandoff, so
+    // no reading of REAPER's hit-test — recognised, unrecognised, or empty — can reach the modal
+    // OLE loop while the pointer is still over a host window.
+    if (ctx.pointerOffHost) return DropClass::OsHandoff;
 
+    switch (ctx.surface) {
         case ReaperSurface::TrackPanel:
         case ReaperSurface::FxSurface:
             // One instance holds one capture, so a multi payload names no instrument to build —