Stabilize Windows UIA validation

[coneilen]

Summary

Makes the Windows native UIA qualification gate reliable on shared interactive
desktops and long worktree paths, so successful product behavior is no longer
reported as failed validation or blocked cleanup.

Changes

• synchronize native popup selection and use bounded, target-owned fallbacks
  when shared-desktop SendInput does not reach the verified menu, combo,
  button, edit, or navigation target
• preserve exact native input receipts and record every fallback in retained
  evidence instead of silently treating message delivery as physical input
• clean up reparented zmx fixture processes by exact executable identity and
  pre-run process baseline
• add -ShellValidationRoot so isolated UIA fixtures can use a
  path-budget-safe owned root
• extend validation contracts for hover acknowledgement, fallback evidence,
  provider cleanup, and short-root isolation

Test plan

RED: pwsh -NoProfile -File Tools\windows\uia-live-gate.ps1 -Shell graphcode-windows\zig-out\bin\graphcode-windows.exe -Zmx .graphcode-tools\providers\zmx\zig-out\bin\zmx.exe -> canvas edge Edit Edge popup remained open after the measured click with hilite=false
GREEN: pwsh -NoProfile -File Tools\windows\validate.ps1 -Task windows-shell -ShellPart integration -SkipTrayLive -ShellValidationRoot C:\v5 -SwiftExecutable $env:GRAPHCODE_SWIFT633 -> exit 0; native UIA gate completed and provider cleanup terminated 8 owned fixture processes
REGRESSION: pwsh -NoProfile -File Tools\windows\Tests\WindowsShell.Tests.ps1 -ZigExecutable $env:GRAPHCODE_ZIG0152 -> 52/52 sections passed, App 736/736 passed, Worktree process 21/21 passed

Checklist

• I have read the Contributing Guidelines
• I have signed off my commits (git commit -s) per the DCO
• Tests pass locally (make test)
• Code follows the existing style (make check)
• I added the test/contract before the implementation and observed the intended RED failure

make test and make check are macOS entry points and were not run on this
Windows host; the Windows-specific commands above are the applicable repository
validation.