[BUG] Ctrl+V image paste deterministically crashes CLI — Bun 1.4.0 SIGBUS at 0xBAD4007 on macOS 26.5 (any image, 3/3 repro)

## Description

Pressing `ctrl+v` to paste an image from the clipboard **deterministically crashes the entire Claude Code CLI** with a Bun runtime panic:

```
panic(main thread): Bus error at address 0xBAD4007
oh no: Bun has crashed. This indicates a bug in Bun, not your code.
fish: Job 1, 'claude' terminated by signal SIGBUS (Misaligned address error)
```

Reproduced 3 out of 3 attempts, with two different images, identical crash signature every time.

## Environment

- Claude Code: **2.1.237** (latest at time of filing; also observed on the same day's earlier build)
- Bun: **1.4.0** (bundled), `M_1fdb5e06` build
- OS: **macOS 26.5.2**, arm64 (Apple Silicon)
- Terminal: kitty 0.41.1 (no custom keymaps), fish shell, inside a herdr 0.8.2 pane — the multiplexer only forwards the keypress; the crash occurs inside Claude Code's clipboard read
- `editorMode`: default (not vim — this is not #76072's key-swallowing; the paste handler *is* reached and then panics)

## Reproduction (100% on this machine)

1. Copy **any** image to the clipboard. Tested with:
- a ~186 KB image copied from a browser, and
- a **3.6 KB** macOS system PNG set via `osascript -e 'set the clipboard to (read (POSIX file ".../shadow-light-4px.png") as «class PNGf»)'`
2. Run `claude`, focus the input.
3. Press `ctrl+v`.
4. Instant SIGBUS panic; the whole CLI process dies.

Crash report URLs emitted by Bun (two separate runs, near-identical traces):

- `https://bun.report/1.4.0/M_1fdb5e06mgkgkIugogC_______+o1yF_mmxwuDmr2nuDuo6u/Cuw0t/Cupv3kD+8wvnD2ipxM__mr2nuD+ihv1CA4Augg11L`
- `https://bun.report/1.4.0/M_1fdb5e06mgkgkIuhogC_______+o1yF_mmxwuDmr2nuDuo6u/Cuw0t/Cupv3kD+8wvnD2ipxM__mr2nuD+ihv1CA4Augg11L`

## Analysis

A likely relevant detail: on macOS 26.5, the pasteboard **auto-promises nine representations for any copied image**. Even for the 3.6 KB system PNG above, `osascript -e 'clipboard info'` reports:

```
«class PNGf», 3660, «class AVIF», 5100, «class 8BPS», 5160, GIF picture, 64,
«class jp2 », 4924, JPEG picture, 5054, TIFF picture, 5912, «class BMP », 2554, «class TPIC», 392
```

So every image paste on this OS version presents AVIF / Photoshop (8BPS) / JPEG-2000 / TPIC flavors alongside PNG/TIFF. If the clipboard reader enumerates or converts promised flavors, one of the newer ones is a plausible trigger — which would explain why the crash is image-independent and size-independent on macOS 26.5 while most users (on older macOS) don't see it.

`0xBAD4007` looks like a poisoned-pointer sentinel rather than a wild pointer.

## Ruled out

- Image size/content/source (a 3.6 KB system PNG crashes identically to a browser image)
- vim editor mode, terminal keymaps, multiplexer key handling
- Image ingestion in general: **drag-and-drop of an image file and file-path references work perfectly** — only the clipboard-read path crashes

## Possibly related

- #85102 — identical crash signature (Bun 1.4.0 SIGBUS, macOS 26, arm64), attributed there to heavy file I/O; may share the underlying memory bug.

## Workaround

Drag the image file onto the terminal, or reference the image path in the prompt.

Start by reproducing Ctrl+V with the minimal 3.6 KB PNG on macOS 26.5, then inspect the Claude Code clipboard-read path and the two linked Bun crash reports. Investigate the promised clipboard representations, especially AVIF, 8BPS, JPEG-2000, and TPIC; done means image paste no longer terminates the CLI with SIGBUS.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.