test(cua-driver): restore NixOS desktop matrix

[r33drichards]

What changed

Restores the NixOS Linux desktop certification surface removed by #2184 / 5abbd802690d68f7d9e79b7fe20bcc0c078652f1, adapted to the current packaged driver and native Wayland opt-in. The NixOS VM checks remain focused on service/session integration while the existing Rust E2E runners retain the shared typed behavior contract.

Coverage map

Surface	Coverage
X11	service/MCP integration, screenshot/capture, cursor/click, background terminal/input, real Xorg parallel drag, GTK4/Qt6/Electron GUI rows
Native Wayland	integration, screenshot/capture, cursor/click, background terminal/input, parallel drag, GTK3/Qt6 GUI rows
Sessions	XFCE/labwc, XFCE/Sway, KDE/KWin, GNOME/Mutter; each uses the host compositor socket with DISPLAY unset
Evidence	GIF/PNG copied from NixOS test outputs; workflow uploads per-cell artifacts and preserves JSON/MP4 if emitted by current recorders

The pull-request gate is intentionally bounded: X11 integration/capture/cursor plus native Sway integration/cursor/background-terminal. The maintainer-dispatched full scope runs all X11 and Wayland cells. Static tests fail if the workflow, flake check wiring, source fixtures, automatic smoke, artifact upload, or summary links disappear.

Observable behavior goals

The restored matrix preserves observable X11, Wayland, and compositor behavior
with inspectable artifact evidence: cursor/click, background terminal input,
parallel drag, screenshot/capture, and representative toolkit GUI interaction.
It does not claim that a post-#2184 issue would definitively have been caught
unless an exact historical scenario and assertion demonstrate that link.

Validation

• Passed: /tmp/actionlint/actionlint .github/workflows/e2e-nixos-desktop.yml.
• Passed: python3 .github/scripts/tests/test_nixos_desktop_matrix.py -v (3 tests).
• Passed: bash -n scripts/ci/linux/run-rust-e2e.sh scripts/ci/linux/run-rust-e2e-wayland.sh.
• Passed: git diff --check.
• Not run locally: Nix was not installed in this environment, so nix flake check and nested NixOS desktop VM builds could not be executed locally.
• Earlier bounded-smoke logs exposed source-owned setup mismatches: missing Nix container UID allocation settings, then historical native-Wayland fixtures that discarded the positive launch_app PID when list_windows omitted it. The latter produced schema/target errors for cursor and background-input calls. Both repairs are included through 883165bd2; bounded smoke is dispatched for that exact head without asserting a result in advance.
• The pre-existing repository-wide Python test discovery could not start because this environment has no pytest installed (8 import errors); the new stdlib static test is run directly above.

Scope and attribution

No secrets, production configuration, release, or deployment behavior changed. Action uses in the new workflow follow the repository's SHA-pinned convention. Historical test material is credited in commit c37967970 with Salvaged from #2184 and the original author as co-author.

Final Exact-Head Validation

• Bounded smoke succeeded for 883165bd2a8f9b031593cbc504ea149fcd93d59b in run 30556211889: exact-source resolution, NixOS / x11-integration-capture, and NixOS / sway-native-input all completed successfully.
• Evidence artifacts are available and unexpired: nixos-desktop-x11-integration-capture and nixos-desktop-sway-native-input.
• Residual gap: the expensive manual full compositor/scenario matrix was not dispatched or executed. This PR therefore provides bounded X11 and Sway smoke evidence only; it makes no broader platform-behavior claim beyond the configured checks.