fix(cua-driver): bind rootless XWayland browser windows

[injaneity]

Summary

• Problem this solves: rootless XWayland compositors can omit or leave EWMH client lists empty while nesting real application clients below compositor-owned frames. Cua then reports no X11 window and treats embedded Chromium as a read-only heuristic in mixed Wayland and XWayland sessions.
• What changed: Cua now performs a bounded fallback traversal for viewable ICCCM clients with _NET_WM_PID, a title, and WM_STATE. Browser binding checks PID-owned X11 identities before native-Wayland adapters, which restores exact embedded Chromium binding and trusted CDP input.

Related work

Refs #2206

#1991 addresses the distinct Xauthority connection failure reported in #1978. This PR neither supersedes nor reimplements that contribution; it handles missing EWMH client lists after the X11 connection succeeds.

RFC: not required. This is a Linux implementation correction and does not change a public SDK, CLI, MCP, protocol, compatibility, permission, or cross-component contract.

Compatibility and risk

• User-visible, API/CLI/MCP, migration, permission, or platform impact: Linux rootless-XWayland applications can now be discovered and bound through their exact X11 identity. Nonempty EWMH client-list handling and native-Wayland fallback behavior remain unchanged. There is no API, schema, migration, or permission change.
• Risk and rollback: fallback enumeration could admit an unrelated nested X11 window, so candidates must be viewable and provide PID, title, and WM_STATE evidence. Traversal is limited to eight levels and 4,096 discovered windows. Exceeding that budget fails closed instead of returning a partial list that could be mistaken for singleton ownership. Reverting this PR restores the previous EWMH-only behavior.

Validation

• Exact candidate: 019a594b0bb4369eb51e12e3d3bfc218c8311a38, rebased onto origin/main at 9a61050e3474fc9488d7adc85184299f02514d0e.
• Focused checks: cargo fmt --all -- --check; Linux container cargo test -p platform-linux --lib --locked x11::tests -- --nocapture (7 passed); Linux container cargo test -p platform-linux --lib --locked browser_platform::tests::exact_x11_identity_wins_in_mixed_display_sessions -- --exact --nocapture (1 passed); live Xvfb cargo test -p platform-linux x11::tests::live_nested_client_fallback_lists_reparented_client --locked -- --ignored --exact --nocapture --test-threads=1 (1 passed).
• Manual platform evidence from the original candidate: Weston 13 with rootless XWayland 23.2.6 and Electron 39.8.5 returned the PID-owned 1280x800 client, produced an exact mutation-enabled embedded binding, delivered event.isTrusted=true to an accessibility-hidden custom control, and opened the native GTK picker. An Xvfb and Openbox comparison retained exact 900x650 Electron discovery and mutation-enabled binding.
• Known gaps or CI still required: generic raw XTEST foreground input still fails closed when a rootless compositor exposes neither EWMH activation nor a compositor control protocol. Exact-head Linux CI passed, including the automated Xvfb nested-client regression. The Ubuntu contract lane passed on rerun after an unrelated temporary-fixture spawn transiently returned ETXTBSY (Text file busy); the full representative desktop matrix remains deferred for final pre-merge certification.

Contributor and release checks

• The PR is focused and the description matches the final diff.
• This change does not require an RFC, or the accepted RFC is linked above.
• Tests, documentation, and platform evidence are included or the gap is explained.
• The PR title is a Conventional Commit describing the production change.
• External contributor authorship is preserved, or no external contribution is included.
• If release-tracked files changed but this is intentionally non-releasing, the no-release label is applied. This is a releasing bug fix, so the label does not apply.