fix(cua-driver): allow explicit unrestricted envelope sessions

[f-trycua]

Landing order

Merge into the #3654 accessor branch, which already contains #3655's lifecycle/deadline correction. This keeps the completed accessor and explicit trusted-launcher permission mode together for their later main-branch landing. This branch merge is not a release, image rollout, or new authorization mechanism.

The mode changes remain identical to the reviewed candidate; refreshing ancestors has not changed these six files. Current PR checks pass. The complete follow-on candidate at 43a332a66d8379b4fb9330c6a96f0654cc4afea1 also passes Linux E2E, Windows unit/compile, and contract/binding validation. Its final Windows shared-app lane is tracked separately.

Earlier notes below preserve their original test checkpoints, not the current merge disposition.

Scope

Refs #2512. Stacked on #3655; keep this PR draft and unmerged.

The private typed carrier previously requested a Standard session even when
its daemon admitted only Unrestricted. These modes are an explicit allowed
set, not a privilege ordering, so connection creation failed with
session_unavailable.

Add the trusted-launcher-only CUA_DRIVER_ENVELOPE_PERMISSION_MODE setting.
Standard remains the default. Unrestricted requires an explicitly opted-in
carrier and an already acknowledged unrestricted daemon. HTTP requests cannot
select permissions or manifests. No generated interface, core authorization,
Fleet authorization, or existing computer-server behavior changes.

Bounded mode and carrier manifest configuration remain unsupported. The SDK's
compatibility-call and trusted-session manifests remain separate contracts.
This carrier limitation is not a change to that SDK model.

Validation

• All 12 focused carrier tests pass, including process-isolated defaults,
  opt-in, missing acknowledgement, invalid modes, and manifest rejection.
• cargo fmt --all -- --check and git diff --check pass.
• Independent source review found no blocking correctness issue.
• All 48 focused Sandbox typed/native bridge tests pass.
• Exact-candidate contract CI
  and the full Linux desktop workflow
  pass at 89ea6e5ed237c95e847d648af8f0a54e51e1e521.
• A disposable Linux Fleet guest proves typed capture and exactly one synthetic
  button click, connection close and reacquisition, actual daemon restart,
  rejection of the old binding, and a successful fresh connection. Existing
  server shell/files and the released daemon remain intact. Claim release and
  owned namespace removal are verified. This is staged-candidate evidence, not
  published-image qualification.
• Windows desktop workflow:
  shared apps, capture, and installer pass. One native WebView2 background-click
  cell fails with the previously reported cua-driver/Windows: preserve UIA unavailability during WebView2 background clicks #3621 UIA-cooldown/PostMessage chain.
  The relevant Windows platform and test sources are unchanged from the parent.
  This result is not green and no test was weakened or replayed to hide it.
• A disposable Windows Fleet guest also proves typed capture, exactly one
  visually reviewed synthetic click, close/reacquisition, actual daemon
  restart, stale SDK/remote/generation rejection, and fresh capture. Existing
  server shell/files/screenshot and the released daemon remain intact. Claim
  release and namespace absence are independently verified. Earlier failed
  setup attempts are not counted as passes, and an uncertain action was not
  replayed. This is staged-candidate desktop proof, not AX/window coverage or
  published-image qualification.
• Both live proofs use runtime candidate 89ea6e5ed237c95e847d648af8f0a54e51e1e521.
  Final commit e4d58d39e53b802251733187aa26efaa59863158 only corrects SDK
  docstrings, development documentation, error wording, and its test regex.
  All 48 focused typed/native tests plus Ruff lint/format pass after that delta;
  no runtime control flow or generated interface changes.
• Full premerge sign-off remains open for the canonical Windows cua-driver/Windows: preserve UIA unavailability during WebView2 background clicks #3621 failure.

Boundaries and rollback

The endpoint stays loopback-only behind the existing environment carrier.
This does not authorize public exposure, ship an image, or publish a release.
Rollback before merge is to omit this stacked PR; tests requiring an
Unrestricted typed session then remain unavailable. Parent stack review and
explicit merge/release decisions remain separate.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!