fix(qa): drive input in the active rendered viewport

[pathscale]

Native application QA exposed driver and protocol defects that could address a retained control, misclassify viewport-fixed UI as off-screen, omit real text-entry roles, or report a control as unverified when a check directly measured its state change.

This branch now:

• prefers visible painted controls and re-resolves planned controls against the live semantic tree;
• uses the renderer-reported CSS-pixel viewport and preserves client/page pointer coordinates after scrolling;
• marks window-anchored fixed descendants in the protocol, including descendants whose DOM parent has scrolled;
• reports whether sortable row and column headers are actually focusable;
• recognizes combobox, searchbox, spinbutton, and textarea input roles;
• updates date, time, month, week, datetime-local, and color controls through SetValue and dispatches their input event;
• supports an exact FocusMoves outcome for composite keyboard navigation;
• attributes ValueChanges, SelectionChanges, and NameChanges to the measured subject, and pointer-drag outcomes to the dragged control;
• keeps identity failures separate from outcome attribution, so a missing or duplicate ID cannot hide a missing behavior check;
• audits baseline controls against the complete application manifest so isolated component groups do not fail on shared navigation that another group owns.

Local release evidence:

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets -- -D warnings passes against the published ps-blitz 0.4.9 dependency graph
• blitz-control-protocol: 80/80 tests with capture enabled
• ps-qa: 161/161 tests
• CLI tests: 2 pass, 1 documented font-host test ignored
• UI native component sweep: 101/101
• js.software: 600/600 across 13 groups, including real pointer sliders and fullscreen fixed controls
• js.software inventory: 287/287 outcome-attributed controls, zero unverified, and zero missing, unstable, or duplicate IDs
• read-only Progress identity/update proof passes through the measured-subject outcome path

The branch resolves directly against the published ps-blitz 0.4.9 crate set, and all three repository checks pass. Owner review and merge are the remaining steps before publishing blitz-control-protocol 0.5.1 and ps-qa 0.7.2. This PR does not publish or release any crate.