fix(cua-driver): reject mismatched native window pixel geometry

[injaneity]

Scope

Refs #3631. Stacked on #3616 (parent baseline 3d13b8037578e27d91d1832c2f23f9847d7917f5); this is the implementation workstream, not another RFC-only artifact.

Preserve useful native captures and semantic accessibility actions while reporting logical/compositor disagreement and refusing confirmed mismatched pixel targeting. Preserve the parent’s runtime-owned snapshot cache, retained admitted elements, and prepared-snapshot publication ordering. Geometry is fresh evidence, not a second identity authority.

Progress

• Add common validated rectangle comparison with caller-supplied point tolerance and no hard-coded production threshold.
• Cover measured Calculator and small-window thumbnail dimensions, valid small windows/negative origins, each rectangle component, tolerance boundaries, and invalid native values.
• Collect bounded exact-window geometry around native capture; distinguish unavailable and unstable evidence.
• Project observation limitations without discarding images or usable AX trees.
• Gate direct and implicit pointer routes; retain admitted elements across reads and preserve terminal refusals through fallbacks.
• Extend snapshot publication/race and AppKit event/focus/cursor coverage.
• Calibrate normalization, tolerance, and metadata budget with native evidence.
• Certify the stable combined candidate using canonical desktop harnesses and Stage Manager coverage.

Validation

Initial comparison test was red because the new types were absent, then green after implementation.

From libs/cua-driver/rust:

• cargo test -p cua-driver-core --lib native_window_geometry --locked: 6 passed.
• cargo test -p cua-driver-core --test snapshot_invariants --test snapshot_dispatch_invariants --locked: 10 passed.
• cargo fmt --all --check: passed.
• git diff --check: passed.

Known gaps

This first slice is not wired into product capture or dispatch; #3631 is not fixed yet. No new protocol fields or unknown-geometry refusal policy ships in the current diff. Native normalization, threshold/budget calibration, public-contract projection, and end-to-end evidence remain pending. Prior investigation is diagnostic evidence, not certification of this branch. Do not mark ready or merge based on these unit tests.

Stack maintenance

Rebase when #3616 changes and test the resulting combined candidate. After its squash merge, transplant only this child’s commits onto main, retarget this PR, and verify that the parent implementation is absent from the child diff. Preserve parent contributor history while stacked; do not duplicate its ownership/cache machinery.