build(cua-driver): add profile-based Hyprland rebuild kits

[f-trycua]

Scope

Refs #3550. Adds a profile-based native rebuild kit and qualification harness
for the optional Hyprland plugin. Downstream integration remains in
Omarchy package PR #346.

Published Driver 0.24.0 source assets remain unchanged. Schema 1 retains its
original-source restriction; schema 2 identifies separately reviewed repaired
source. Source integrity, compiler/compositor compatibility, mandatory tests,
production build flags, opt-in installation, and fresh-session replacement
remain required. The initial application profile covers native Wayland
Inkscape on stable x86_64 with two trusted owners in one desktop account.

Earlier repaired-candidate qualification

Tested native harness: 136ceee6850ee08a2c1c092e55478196a4db8f63.
At that checkpoint, PR head a9a1481be945847e89543a7646605eba18b8669e included the main sync,
schema 2 usage/README corrections, documentation alignment with the tested
duplicate-notification contract, and merged repair #3702. The executable
profile tooling and native qualification harness remain unchanged from the
tested harness; the repair adds its separately tested fault-policy fixture.
Repair #3702 merged as 648c251400ebb356f6d7dbc3d0c835690b9bb4b4, with
the same complete plugin subtree as package source
f256623c97a4f59931f37599d7209e7cb50802ac, whose
executable product source equals e1a41547901acef248d64773ec4f99cffd79dded.
The diagnostic proofs use that repaired source with installed Driver 0.24.0.

• Later-motion configuration, keymap, DPMS, active-lock, and two-sample human
  takeover cancellation and fresh recovery passed. Unsupported-layout and
  settled-lock refusal passed without dispatch. Deliberate lock/takeover
  transitions remain outside continuous-isolation claims.
• Idle expiry/reconnect passed after the real 60-second timeout. Isolation
  claims cover the separately traced action intervals. Same-client passive
  hover refusal and original-owner-lane recovery passed; active-lease conflict
  and other-lane recovery are not claimed.
• Target destruction and distinct-target recovery now pass together: exact
  pidfd termination, resource pruning, bounded connection retirement, a fresh
  click-selection transition, and runtime-close cleanup. All 20 trace rows
  were checked. Two primary motion notifications retained the exact unchanged
  position; no displacement, focus, held-input, or foreground-input violation
  occurred. Recovery cleanup permits approved inert pointer presence with no
  reservation or input authority. The preceding attempt remains failed on
  cleanup; earlier failures are also retained. Interrupted actions were not
  replayed.

The trace-disabled candidate download recipe passed fresh, extraction-reuse,
repackage with --nocheck, and --skipinteg paths. Each passed all 16 mandatory
CTests. A tampered archive was rejected even with --skipinteg. All four paths
produced identical module and build-provenance bytes; package archive hashes
are recorded separately. This used a preseeded candidate archive and does not
prove a published download. Separate native production-package results follow.

Candidate artifact	SHA-256
Trace-disabled module	65e362aba8b0b6c187b1952791e5a57705cf22262ec100b1c8c6d9ed18215324
Fresh package	978d085e985694a339dcc617b57a41ea079abd27df0dab06cdc55dc9a93872c8

The kit tooling is independently pinned to
1a9c4985b3e1575ad3bd95182bede74c76789cff; the wrapper qualification used
harness e4dfabbe0ceb95391f3e7cfd476bda5a85922ea4. The candidate source version
string 0.26.0 is not the published 0.26.0 release. Its final source must match
the correct immutable component tag before publication.

Further completed gates on the repaired candidate:

• Diagnostic pointer episodes passed with 1,529.67 ms of overlapping drag
  delivery, saved SVG effects, and no unexpected primary motion, focus, or
  held-input violations. Two owners retained their lanes while a third received
  exact background_unavailable/lane_busy with zero dispatch. The diagnostic
  warp-and-return control correctly failed the isolation detector.
• A cold package installation passed integrity and consumer checks, followed
  by a fresh compositor mapping the exact installed trace-disabled module.
  Cold rollback, re-upgrade, removal, and reinstall also passed, each with a
  distinct fresh compositor. Installed states mapped the exact expected module;
  removal left no payload or plugin mapping and retained desktop capture.
  Driver/Inkscape saved-output checks passed after each installed transition.
  These are representative checks, not new continuous-isolation claims. The
  chained transaction archive SHA-256 is
  dcbb935b35758f06133370974f813fb8afe4e1e013dce088ba2d35b34a597e66.
• With the actual cua-driver-bin 0.24.0-1 binary, two independent Inkscape
  clients passed Ctrl+A/Right/save and click/scroll/drag/save proofs. Saved SVG
  and screenshot oracles verified the effects. The independent primary observer
  covered all six keyboard and 10 pointer action intervals while its left mouse
  button stayed held. Two pointer-motion notifications repeated the exact same
  primary object and position; focus, input, and foreground interaction were
  unchanged. Any real displacement remains a failure.
• The same independent observer caught an intentional 50-pixel excursion and
  return despite equal endpoints. This production negative control proves the
  detector remains sensitive; it is not an isolation pass for that action.

Production proofs are bounded production-package-smoke evidence, not
continuous compositor attribution or complete desktop-matrix coverage.
Local verification ran 591 harness tests with one Linux-only skip on macOS,
plus 113 release/profile tests without failures.

The unchanged complete Linux runner passed on native Hyprland with source-built
Driver 0.24.0 at 4b3396d9fe4bd3cf723b0eb8db83c18a8764b520 and the repaired
installed plugin: 128 unique cells, 87 delivered, 41 expected refusals, zero
failures, and zero skips. Independent verification checked every required lane,
video/evidence validation, run identity, source/fixture/executable identities,
package, and mapped module. The source-built executable is distinct from the
packaged Driver used above; this is not current-main or Driver 0.26.0 coverage.
The retained review archive SHA-256 is
709da61e4865d98df738aff49c00b613949744c30aaf111578452bca94a56d1e.

Final released-source package evidence

The schema-2 profile selects exact component tag cua-driver-rs-v0.26.1 at
cc54254464c0c9aebfd6547fe7e4a0ceaf0456d7. Source archives generated locally
and by the release workflow are byte-identical. Kit tooling is pinned to this
PR's final candidate 67f89ceb47edd973aa748820eadd02ddbfb3d3e4.

Final artifact	SHA-256
Kit archive	a89bfa7f6490f598719dfabdd2a5badc137e27b0764fd25e6a05e1f969433520
KIT-PROVENANCE.json	7beb736adfd334eed52e84070177634269e3a09f8bb25971b38606933ff4c997
Download wrapper	51a50ea69db126bcc043bb8721df17477124cdaeceab646486c8586ce308b99a
Fresh unsigned package 0.26.1-2	aaa4b39fc32e7b8c74ab14c9801a7e787107674f1f873364dfe50c8d0bdf5016

All four final native build paths passed every one of the 16 mandatory CTests;
tampering was rejected under --skipinteg. Independent comparison confirms the
module, source inventory, native profile, and executable tooling are identical
to the repaired candidate qualified above; only release/provenance metadata
changed. Final build evidence archive:
4bf3fabfe1b0ebedac72b4f5b3c123653aa0ac4c242a665f41d60a38692d0417.

A guarded cold upgrade passed package integrity and consumer compatibility,
followed by a new compositor mapping the exact final module. Transaction digest:
4cc3b4ce835f24a80b96476b8fa472e481c0d91aba74cf69a344d1e691149917.
A fresh background Ctrl+A/Right/save through actual packaged Driver 0.24.0-1
moved the Inkscape rectangle by two document units and saved the SVG while the
foreground fixture stayed selected. Result digest:
9a07dd3ef1ce8e1c66cbe340228c674a56eef5190a93f273c403ffd79f8c7b21.
All five setup clients were subsequently retired through Driver and ordinary
Driver services remained active. This final smoke is representative app proof,
not a new concurrency or continuous-isolation claim. Earlier stale-helper and
setup-service lifetime failures stopped before package mutation or app input,
respectively; those attempts remain retained as failures.

Historical evidence and remaining gates

Original Driver/plugin 0.24.0 qualification passed production-package pointer
and keyboard effects, diagnostic two-lane overlap and capacity, and a complete
full-resolution canonical Linux run with 128 results and no failures or skips.
The default resized-image path remains affected by #3700. Those historical
passes retain their original identities and do not certify repaired bytes.
The original later-motion app-recovery defect is tracked in #3701 and repaired
separately in #3702.

This PR merged as a7d1645fbeb62782e25d8ec63ac37330a1a99645, with an
identical tree to candidate 67f89ceb47edd973aa748820eadd02ddbfb3d3e4.
All 113 packaging tests passed again at the merge SHA. The source repair and
Driver 0.26.1 release PR #3707 are merged; the immutable component tag resolves
to cc54254464c0c9aebfd6547fe7e4a0ceaf0456d7 and its release is public.

Profile kit 1.1.0
is published without replacing earlier release assets. Anonymous source/kit
downloads match the qualified files. The exact downstream wrapper fetched
the public kit into a fresh native directory and passed makepkg --verifysource.
The qualification record
documents the final identities and bounded claims.

The final kit's native build matrix, byte comparison, cold upgrade, fresh
compositor mapping, and saved-output Inkscape smoke passed. Test clients were
retired and ordinary Driver services remained active. Final cold evidence
archive: d41718ed8a1b003565d1fad693e1d9b7c6c016f25fcfc7dc85e0e2384510e27e.
Final app/retirement archive:
b2535555560e211d7c09518dc4b8a1e2e3907c721528ba1060042cff2bb9b7f8.

Omarchy owns integration, Omabot replay, and signing/publication. A named
downstream release owner and fresh signed installation remain required.
Downstream #346 remains held and excluded from scheduled builds until
Omarchy's own gates pass. A Fleet qualification is not an Omabot replay.