Close the bridged-process hole in the drag-out hand-off gate

OsHandoff now needs the window-ownership proof AND a hit-test that named
nothing, so a bridged plugin's UI can't read as off-REAPER.

src/core/ui/drag_out.cpp

@@ -24,10 +24,16 @@ DropClass decideDropClass(int px, int py, const PanelClientRect& client,
     if (!ctx.drag.dragging || !ctx.drag.hasArmedSamples) return DropClass::None;
     if (insideClient(px, py, client)) return DropClass::Internal;
 
-    // The hand-off gate sits AHEAD of the surface switch and is the only route to OsHandoff, so
-    // no reading of REAPER's hit-test — recognised, unrecognised, or empty — can reach the modal
-    // OLE loop while the pointer is still over a host window.
-    if (ctx.pointerOffHost) return DropClass::OsHandoff;
+    // The ONE route to OsHandoff, ahead of the surface switch, and it needs BOTH halves. The
+    // shell's ownership proof alone is not sufficient: REAPER runs a bridged plugin's UI in a
+    // separate process, so a window failing that test can still be REAPER's own UI. A recognised
+    // token therefore VETOES the hand-off instead of producing one — a veto can only move the
+    // answer toward staying inside REAPER, so pointerOffHost remains the only member whose true
+    // value can reach OLE. An off-host point REAPER DID name falls through to that surface's own
+    // outcome below: over a bridged FX window that is the instrument drop, as it is for a native
+    // one.
+    if (ctx.pointerOffHost && ctx.surface == ReaperSurface::Other && !ctx.haveTrack)
+        return DropClass::OsHandoff;
 
     switch (ctx.surface) {
         case ReaperSurface::TrackPanel: