fix(cua-driver): preserve foreground focus during macOS clicks

[RubinCarter]

Summary

• replace the macOS background pixel-click focus-without-raise sequence with target-only synthetic focus
• never send defocus or restore records to the user foreground process
• skip target deactivation if the user genuinely activates that target while the click is in flight
• fail closed when the private target-only route is unavailable and clean up target state on errors
• keep target activation under the existing strict focus-suppression observer
• extend the foreground sentinel with native BrowserWindow blur so AppKit-level loss cannot hide behind unchanged DOM focus
• require the existing background raw-double-click E2E cell to attest that it used target-only synthetic focus

Refs #3331

Salvaged from iFurySt/open-codex-computer-use#48.

Validation

• cargo fmt --all -- --check
• cargo test -p platform-macos (362 passed, 2 ignored)
• cargo test -p cua-driver-testkit (56 unit tests and 2 integration-schema tests passed)
• cargo test -p cua-driver --test harness_appkit_test --no-run
• node --check libs/cua-driver/tests/fixtures/apps/cross-platform/electron/main.js
• focused target-only record, plan, user-takeover cleanup, and native-sentinel classification tests pass

Pending native evidence

The local console session is currently locked (CGSSessionScreenIsLocked=Yes). The covered-target focus test cannot establish an active/key foreground sentinel while locked, so no native focus-preservation result is claimed yet. After unlock the sentinel first runs a deliberate focus-loss/input-leak canary, then the background raw double click must prove target effect, target-only route use, unchanged frontmost PID, no native or DOM blur, unchanged real pointer, unchanged z-order, and safe user takeover.

Known unrelated validation noise

cargo clippy -p platform-macos --all-targets -- -D warnings is currently blocked by pre-existing lints in cursor-overlay and other untouched platform-macos files under Rust 1.98.