Fix drag-out giving live drags to OLE: prove the pointer left REAPER

OffReaper leaves the surface vocabulary; OsHandoff now gates on a window-ownership
proof resolved in the shell, so no in-REAPER surface can reach DoDragDrop.

src/shell/actions/instrument_drop_win.cpp

@@ -83,7 +83,7 @@ DropProbe probeDropTarget(int screenX, int screenY) {
     // doc-comment says so), so the track and the surface are two independent facts and both
     // are reported. The pure classifier owns every token rule.
     out.track = GetThingFromPoint(screenX, screenY, info, sizeof(info));
-    out.surface = classifyReaperSurface(info, out.track != nullptr);
+    out.surface = classifyReaperSurface(info);
     return out;
 }