macOS system Pinyin English candidate moves the caret and corrupts adjacent text

Does this issue occur when all extensions are disabled?: Yes

- VS Code Version: 1.135.0 (commit 08d4889f9ec4a1685d257b9b95de036c8e1ce1e5, arm64)
- OS Version: macOS 26.6.2 (build 25G83, arm64)
- Input Method: macOS built-in Pinyin - Simplified

Steps to Reproduce:

1. Launch VS Code with all extensions disabled.
2. Create or open a plain text file whose first line contains only `1234`.
3. Place the caret immediately before `1`, so the caret position is `|1234`.
4. Switch to the macOS built-in Pinyin - Simplified input method.
5. Type `revie`. The editor correctly displays `revie|1234` at this point.
6. Type `w`. An English candidate for `review` appears, and the editor caret incorrectly moves after `1`. The visible state is equivalent to `revie1|234`.
7. Press Return to select the `review` candidate.

Actual Result:

The first line becomes `revieww234`. The character `1` to the right of the original caret is removed, and an extra `w` is inserted.

Expected Result:

The caret must remain before `1` while the candidate is pending. Selecting the candidate must preserve the text to the right of the original caret, producing `review1234` with the caret immediately after `review`.

Comparison with Microsoft Edge:

The same input sequence in an Edge text field can temporarily display `revie1234` with the caret after `1` when the English candidate appears. However, pressing Space to select the candidate correctly produces `review1234`. VS Code instead commits the temporary caret movement to the editor model and produces `revieww234`.