Close the bridged-process hole in the drag-out hand-off gate

OsHandoff now needs the window-ownership proof AND a hit-test that named
nothing, so a bridged plugin's UI can't read as off-REAPER.

src/shell/actions/drag_out_win.h

@@ -33,11 +33,14 @@ bool initiateDragOut(HWND__* panelHwnd, const std::vector<std::string>& absolute
 // probe HGLOBAL immediately; SWELL exposes no probe, so macOS/Linux reduces to the non-empty check.
 bool canInitiateDragOut(const std::vector<std::string>& absolutePaths);
 
-// True iff a window belonging to the host (REAPER) process sits under the screen point —
-// the POSITIVE proof ui::DropContext::pointerOffHost is the negation of. Every REAPER
-// surface qualifies whether or not GetThingFromPoint can name it: the arrange, a TCP, a
-// floating FX or VST editor window, the transport, the toolbar, a menu, the docker chrome
-// and our own panel are all windows of this process, because the extension runs inside it.
+// True iff a window belonging to the host (REAPER) process sits under the screen point — the
+// POSITIVE proof ui::DropContext::pointerOffHost is the negation of (that member owns the
+// evidence rule). Nearly every REAPER surface qualifies whether or not GetThingFromPoint can
+// name it, because the extension runs inside that process.
+// The exception, and it ships: a plugin set to "Run as separate/dedicated process" draws its
+// UI out of reaper_host32/64.exe, and WindowFromPoint descends to the deepest child — so this
+// reports false over a bridged plugin's editor although the pointer never left REAPER. The
+// law's hand-off gate absorbs that by also requiring REAPER's own hit-test to name nothing.
 // Side-effect-free; safe on every mouse-move.
 bool pointerOverHostWindow(int screenX, int screenY);