feat(cua-driver): support multiple direct runtimes per process

[f-trycua]

Summary

• allow a trusted process to own multiple direct Cua Driver runtimes
• bind sessions, grants, browser references, element tokens, cursor state, recordings, and teardown to an opaque runtime generation
• coordinate inherently process-global desktop input and platform facilities without treating same-process runtimes as a security boundary
• preserve existing constructors, CLI/MCP behavior, SDK method shapes, and the RuntimeAlreadyExists error vocabulary
• document shared-desktop coordination, explicit-session requirements, and private-worker/service boundaries

Closes #2571.

Security and lifecycle properties

• the same public session label may be used independently in two runtimes
• runtime A revocation, idle expiry, shutdown, or drop does not end runtime B
• stale or cross-runtime browser refs and element tokens fail closed
• bulk revocation is scoped to the owning runtime generation
• out-of-band idle/shutdown teardown is mirrored to legacy transport guards without restoring process-global public session state
• native input delivery is serialized across same-process runtimes; this is coordination, not desktop virtualization or same-process isolation

Verification

• cargo fmt --all -- --check
• cargo test -p cua-driver-core --lib --locked — 380 passed
• cargo test -p cua-driver-sdk --lib --locked — 39 passed
• cargo test -p cua-driver --bins --tests --locked
• cross-platform compile check for cua-driver-sdk, cua-driver, platform-linux, and platform-windows
• generated Cua Driver docs drift check
• internal and external documentation link checks
• public documentation hygiene check
• production documentation build
• independent Opus 5 lifecycle/security review: GO, no remaining P0/P1
• all required GitHub PR checks passed

Exact-SHA platform E2E

Certified source: 65cd43c

• macOS Quartz in a logged-in disposable Lume VM: 150/150 expected outcomes passed; 142 delivered, 8 expected refusals, 0 failed, 0 skipped
• Windows in an active FreeRDP user session (not Session 0): 127 cases; 102 delivered, 25 expected refusals, 0 failed, 0 skipped
• Linux X11: successful run https://github.com/trycua/cua/actions/runs/30184447488
• Linux Wayland: successful run https://github.com/trycua/cua/actions/runs/30184448084

Non-goals

• same-process runtimes are not mutually distrusting sandboxes
• runtimes do not receive separate physical or virtual desktops
• private-worker and service topologies remain supported and recommended for crash or trust isolation
• this PR does not create or publish a release