fix(cua-driver): macOS e2e convergence (conv2 3/7)

[f-trycua]

Summary

Third convergence landing PR extracted from #2161, built on the typed evidence foundation and shared fixture journals.

• converges macOS AX bindings, pointer/input delivery, scroll, drag, text entry, and window-change detection
• replaces the old modality test names with typed desktop-scope, installed-app launch, TextEdit, AppKit, and SwiftUI coverage
• updates the AppKit, SwiftUI, and WKWebView fixtures plus build/smoke scripts
• adds the canonical logged-in macOS runner with owned MP4 evidence for every declared row
• re-establishes the foreground sentinel after video capture attaches, excluding instrumentation setup while strictly observing the action itself
• converts Calculator/TextEdit checks from invisible side tests into typed matrix rows with owned recordings

This PR excludes Windows, Linux/Wayland, Nix, and final support docs. The extraction plan is documented on the frozen source branch.

Validation

• exact head: 448d052f1a1b5c1e410e5357fff0bc1c958b2945
• canonical logged-in macOS matrix: 133 passed, 0 failed, 0 skipped
• every declared row passed strict fixture-state/effect validation and produced a playable owned MP4
• cargo test -p platform-macos: 121 passed
• cargo test -p cua-driver --all-targets --no-run --locked
• cargo test -p cua-driver-testkit --lib --locked: 35 passed before the final cross-platform validator addition; focused validator tests pass on the final head
• native AppKit, SwiftUI, and WKWebView fixtures built
• fixture smoke: 28 passed, 0 failed, 4 intentionally unavailable environment probes
• install-local.sh release install succeeded with the existing stable signing identity
• GitHub compile, distro, docs, link, and Nix source checks are green on the exact head

The canonical run used this host's logged-in, TCC-authorized macOS session. Its typed summary and recordings are retained in artifacts/cua-driver/macos from the exact-head run.

Source: #2161.

[github-actions]

📦 Publishable packages changed

• cua-driver-rs

Add release:<service> labels to auto-release on merge (+ optional bump:minor or bump:major, default is patch).
Or add no-release to skip.

[github-actions]

📦 Publishable packages changed

• cua-driver-rs

Add release:<service> labels to auto-release on merge (+ optional bump:minor or bump:major, default is patch).
Or add no-release to skip.

[github-actions]

📦 Publishable packages changed

• cua-driver-rs

Add release:<service> labels to auto-release on merge (+ optional bump:minor or bump:major, default is patch).
Or add no-release to skip.