Agent composer textarea uses unsupported aria-expanded attribute

Agent composer semantics fail axe.

- `aria-expanded` is invalid on the current textarea role.
- WCAG automated gate: critical.
- Reproduced on deployed frontend `67de497a8112c109688e8cb1bbf648759aa6e46f`.

Full context for agent readers

## Problem

The V1 agent composer renders a plain `` with `aria-expanded="false"` and `aria-controls="agent-mention-listbox"`. axe-core 4.10.3 reports `aria-allowed-attr` because `aria-expanded` is not supported on the textarea role. Screen-reader users therefore receive an invalid disclosure/combobox contract.

## Reproduction

1. Authenticate at `https://agent.comfy.org/`.
2. Enable the `agent-in-app-experience` flag in the browser context and open the agent panel.
3. Run axe with `wcag2a,wcag2aa,wcag21a,wcag21aa,wcag22aa` against `#agent-panel-root textarea`.
4. Observe one critical `aria-allowed-attr` violation.

Observed element:

```html
<textarea aria-label="Describe ideas, @ to reference, add nodes from graph or drag in assets" aria-expanded="false" aria-controls="agent-mention-listbox">
```

## Expected

Use a valid accessible-autocomplete pattern. Either give the control the role and complete ARIA contract that supports `aria-expanded`, or remove unsupported attributes when the suggestions list is closed. Preserve the existing accessible name and keyboard behavior.

## Acceptance criteria

- axe reports no `aria-allowed-attr` violation for the composer in closed and open suggestion states.
- A component/browser test covers both states.
- Keyboard and screen-reader semantics for the suggestion list remain intact.

## Evidence

- axe-core: 4.10.3
- Scan time: 2026-09-02T05:41:57Z
- Surface: `https://agent.comfy.org/`
- Served commit: `67de497a8112c109688e8cb1bbf648759aa6e46f`
- Program artifact: `reports/qa/2026-09-02-a11y-evidence/axe-results.json`

</details>

<!-- authored-by:agent lane-ta-57 -->