feat(cua-driver): implement SDK-owned runtime RFC

[f-trycua]

Summary

• implement RFC 2549’s SDK-owned runtime architecture while preserving CLI/MCP as the preferred standalone-agent integrations
• add immutable runtime/session authorization, direct and private-worker ownership, remote envelope negotiation/cancellation, authenticated service sessions, and deterministic shutdown semantics
• preserve standalone macOS TCC ownership while adding explicit cua-driver mcp --direct for hosts that deliberately own attribution
• harden local service and Windows UIAccess boundaries, fail closed in Windows Session 0, and make platform-facility limitations structured and explicit
• retain the earlier browser-scale and nested-Wayland E2E fixes already carried by this PR

Compatibility

• released CLI/MCP defaults, constructors, package exports, schemas, and result envelopes remain covered by frozen fixtures
• previous-release Rust, Python, and TypeScript application sources compile or run unchanged against the candidate packages
• daemon-backed CLI/SDK actions negotiate compatibility before dispatch, including replacement daemons at the same endpoint
• legacy remote-carrier implementations remain source-compatible but fail closed until they advertise cancellation support

Documentation and examples

• document when imported applications should use direct SDK ownership versus standalone CLI/MCP
• document macOS TCC attribution, Windows interactive-session requirements, Linux display ownership, service authentication, and runtime lifecycle
• update the reusable Cua Driver skill and in-process SDK examples
• add previous-release application fixtures for Rust, Python, and TypeScript

Local and standard CI verification

• cargo check --workspace --all-targets --locked
• SDK, CLI compatibility, private-worker, macOS overlay, contract, core parity, and browser setup-UI suites
• generated contract, UniFFI binding, and public C ABI checks
• TypeScript typecheck and SDK tests
• Python UniFFI loader tests
• agent SDK Python/TypeScript example checks
• docs internal/external links, public hygiene, and production build
• release metadata, platform unit/compile, Nix policy/package, script, attribution, and fleet-mirror checks
• git diff --check and sensitive-content scan

Independent review

Claude Code Opus 5 reviewed the complete RFC diff and follow-up macOS setup-UI hardening. All blocking findings were fixed; the final verdict is GO.

Exact-SHA certification

Candidate: 9cf8db8c73966529f32e2ac7f574181f5460e188

• Linux X11 complete Rust matrix
• Linux Wayland complete matrix on Sway
• Linux Wayland complete matrix on the custom compositor
• Windows interactive complete Rust matrix, including installer smoke
• Standalone Chrome on Linux and Chrome/Edge on Windows
• signed macOS 26.5.2 Lume worker: core 142 delivered / 8 expected refusals / 0 failed / 0 skipped; standalone Chrome 13 delivered / 2 expected refusals / 0 failed / 0 skipped; exact source SHA and stable certificate identity verified, with the standard daemon restored after the unrestricted browser lane

This PR is ready for review and intentionally left unmerged.