refactor(cua-driver): clarify macOS drag endpoint semantics

[ctaylor86]

What

Clarifies the macOS drag endpoint semantics after maintainer review of the original follow-up.

The last MouseDragged sample is used only to classify whether the gesture crossed the drag threshold. The emitted HumanEvent::Drag::to remains the MouseUp release position, matching the Windows backend. The classification-only variable is now named accordingly, and a regression test uses intentionally different dragged and release coordinates to prove the distinction.

This focused follow-up targets the owning feat/demonstration-recording branch after #3248 was merged into #2016.

Verification

• cargo fmt --all -- --check
• cargo clippy -p input-capture --all-targets -- -D warnings
• cargo test -p input-capture --no-fail-fast: 27 passed
• cargo test -p cua-driver-core --locked: 427 unit, 2 contract-parity and 3 session-lifecycle tests passed
• git diff --check
• regression sabotage: changing the emitted endpoint back to the last dragged sample makes the new test fail; restoring the mouse-up endpoint makes it pass
• independent fail-closed review of exact commit ce9883c2: passed with no security or logic findings

Follow-up to #3248. Parent contribution: #2016.

[injaneity]

blocking: this changes the recorded endpoint from the release location to an earlier movement sample.

drag_to stores the last MouseDragged event, while (x, y) on MouseUp is where the button was released. those values answer different questions: the dragged sample can classify whether a drag occurred, but the mouse-up sample is the final endpoint. event sampling can legitimately make them differ, so consistency is not evidence that the earlier value is correct. the windows backend also records its button-up position as HumanEvent::Drag::to.

please keep (x, y) as the emitted endpoint and clarify the classification variable instead. if macOS reports unreliable mouse-up coordinates, this needs native evidence establishing that platform limitation. the added test currently enshrines a stale endpoint without such evidence.

[ctaylor86]

Thank you, this distinction is correct. I reconciled the review against the Windows backend and amended the PR: the recorded endpoint remains the MouseUp release position, the last dragged sample is now explicitly named for classification only, and the regression test uses differing samples to prove that behaviour. Exact reviewed head: ce9883c2.