fix(cua-driver): enforce authorization in embedded SDK

[f-trycua]

Summary

• enforce managed/user policy, permission mode, bounded manifests, hard invariants, and reviewed-risk checks at the native tool-registry boundary used by CuaDriver.create()
• validate authorization configuration before constructing a same-process SDK runtime
• publish one machine-readable permission-adapter inventory through SDK and daemon tool discovery plus authorization status
• classify screenshot-to-file operations as R3 file egress instead of ordinary R2 observation
• document the exact active, metadata-only, and not-exposed surface and the reviewed delivery plan for feat(cua-driver): expand active permission-mode enforcement beyond existing-profile attach #2385 and feat(cua-driver): support trusted per-session permission modes in shared daemons #2437

Why

RFC 2447 made the same-process SDK the canonical application path, but that path invoked the native registry without passing through authorize_tool_call. Daemon transports performed the check, so direct Python/TypeScript/Rust SDK callers could bypass the process authorization stack.

This change moves the authoritative check to the shared native dispatch boundary. Transport checks remain defense-in-depth and have no consent side effects.

The adapter inventory remains deliberately narrow:

• browser_prepare.existing_profile is the only active protected-consent adapter
• observation, desktop input, file/egress, and consequential-browser groups remain metadata_only
• device, shell, and generic network groups remain not_exposed

No new user-owned capability is labeled active before a certified protected host and platform certification exist.

Verification

• cargo test -p cua-driver-core — 348 unit tests, 2 contract tests, and 3 session lifecycle tests passed
• cargo test -p cua-driver-sdk — 17 tests passed
• cargo test -p cua-driver sdk_adapter::tests — passed
• cargo clippy -p cua-driver-core -p cua-driver-sdk -p cua-driver --all-targets -- -D warnings -A clippy::missing_safety_doc — passed
• npm run docs:check-hygiene — passed
• npm run docs:check-links — passed
• npm run docs:check — generated Cua Driver and Lume references have no drift

The unmodified current platform-macos source has two pre-existing missing_safety_doc warnings, so the scoped Clippy run allows only that lint while denying every other warning.

Review and follow-up

Claude Code Opus independently reviewed the plan against the exact base SHA and confirmed the same-process bypass. Its accepted findings are incorporated in the checked-in plan.

This is the first dependency-safe slice. It progresses #2385 and #2437 but does not close either umbrella:

• trusted mixed-mode session selection still requires an authenticated action connection (feat(cua-driver): support inherited connected IPC for embedded hosts #2410 or an equivalent multiplexed channel)
• user-owned active adapters still require the protected host/indicator work in feat(cua-driver): add an embedded protected-consent and indicator adapter #2411
• concurrent bounded sessions require replacing the process-global manifest with an immutable per-session store