fix(06-08): the D-09 confirm card survives a live fix — renderCockpit guards the card rebuild

- a fix arriving while the abandon confirm is open rebuilt the guidance
  card over it (the ONE PX-03 exit guard evaporating mid-decision); the
  pump now re-renders banner/list only and the confirm surface survives
  until CONTINUE or YES, ABANDON
- G7b pins it: confirm mounts -> live fix -> confirm still shown,
  guidancePhase=confirm holds, YES ABANDON still tears down
- found while building 06-08's scripted END TRIP capture leg; the real
  drive's step 6 (END TRIP on a live road) would have hit this within one
  watch fix

web/src/route/route.ts

@@ -372,19 +372,25 @@ export function createRouteController(deps: RouteControllerDeps): {
       }
     }
     const eta = g.eta ?? updateEta(null, 0, g.snap.remainingM);
-    deps.showRouteCard(
-      buildGuidanceCard(
-        deps.locale,
-        {
-          ...view.card,
-          minutesRemaining: eta.displayedEtaS / 60,
-          kmRemaining: eta.displayedRemainingM / 1000,
-          etaClock: composeEtaClock(eta.displayedEtaS, now()),
-        },
-        { onEndTrip: openConfirm },
-      ),
-      "bottom",
-    );
+    // G7b: while the D-09 confirm card owns the bottom register, the pump's
+    // per-fix re-render must never rebuild the guidance card over it — the
+    // confirm is the ONE exit guard (PX-03); a live fix re-renders the
+    // banner/list but the confirm surface survives until CONTINUE/abandon.
+    if (!g.confirmOpen) {
+      deps.showRouteCard(
+        buildGuidanceCard(
+          deps.locale,
+          {
+            ...view.card,
+            minutesRemaining: eta.displayedEtaS / 60,
+            kmRemaining: eta.displayedRemainingM / 1000,
+            etaClock: composeEtaClock(eta.displayedEtaS, now()),
+          },
+          { onEndTrip: openConfirm },
+        ),
+        "bottom",
+      );
+    }
   }
 
   function toggleList(): void {