feat(capture): seal native action geometry at capture time

[abrichr]

What changed

Window-scoped Capture now writes each frame, window state, and native input event through one ordered source journal. Pixel acquisition stays outside the journal's observation boundary. If input arrives during a grab, the action binds the previous published frame before the new frame can enter the journal. A frame that might contain the action's result can't become that action's before evidence.

The v2 geometry record includes the window and process identity, display-topology digest, bounds, axis scales, fixed output viewport, source viewport, content rectangle, and geometry epoch digest. Capture rejects a recycled window handle, a process change, a display change, mixed frame geometry, and incomplete action bindings.

Recorder shutdown drains every writer before it seals the capture. The verified loader now requires a continuous v2 journal, a later retained frame for every action, one unambiguous video artifact, and exact agreement among MP4 frame indexes, source ordinals, capture times, database rows, and retained PNG hashes.

Linux window capture resolves a viewable EWMH client and reads its XComposite named-window pixmap. Another window can't replace those pixels through root occlusion. Native Wayland and XWayland-only sessions stop before recording because Capture doesn't yet have a portal contract that binds the selected window, pixel stream, and event-time coordinates.

The browser recorder stays Playwright-native. RDP and Citrix remain pixel-based external surfaces. They use the same exact window-frame path without claiming local accessibility identity inside the remote session.

Why

A timestamp alone can't prove which frame or coordinate system an action used. A window can move, resize, switch processes, or cross a display change while the screenshot and input threads run. The compiler needs one sealed source sequence, not a sequence reconstructed from nearby timestamps.

Checks

• 542 tests passed, with 10 expected skips, when the unchanged browser-bridge file was excluded
• 119 focused geometry, terminal, frame-binding, and video tests passed, with 2 expected skips, in the independent review
• Ruff, the format check, and git diff --check passed
• A real Xvfb/EWMH/XComposite check returned the expected window bounds and exact test pixel
• The wheel and source archive passed the release-boundary validator; both contain the Linux producer, and the wheel keeps xcffib Linux-only

The exact full suite also exposed an existing macOS browser-bridge timeout in TestBrowserBridge::test_dom_event_capture. The same test times out at await ws.recv() on exact base 5ed28e6 and on this head. This branch doesn't change that browser code or test. Exact-head hosted CI is still required.

Three counted deterministic Linux X11 qualification trials remain required before this draft can be ready for merge or release.