feat: integrate window photos on shared display edges#155

Why

Hidden windows need a visible slice on edges shared with another display. This pins the photo implementation in paneru#80 for #150.

What changed

• Show real window photos at the hidden slices, refreshed every two seconds while visible.
• Keep capture off by default, cancel unwanted requests, and reuse window lookups.
• Record the completed integration checks and remaining input work.

Scope

Stacked on #154. The Settings switch and permission prompt are in #152. Click and drag forwarding follows separately. Merge the switch with or after this pin.

Blast Radius

The engine uses Screen Recording only when the option and permission allow it. The compatibility publication guard remains unchanged and requires the engine stack to land first.

Verification

• Prior checks passed engine lint, engine tests, the signed app build, and 167 Swift tests on the pinned engine.
• The integration session verified matching slice pixels and geometry, refresh, permission attribution, and fullscreen, sleep, lock, and switch cuts.
• Documentation checks pass in this continuation. Five release CPU pairs with changing contents measured 2.57% of one core on versus 0.87% off, with no capture errors. A playing AVPlayer video and paused frame were verified in this continuation. Five alternating 10-second pairs measured 2.60% on versus 1.00% off for video, and 2.60% on versus 1.10% off for the still frame. All 25 video photos repainted. All 25 still photos were unchanged and caused zero repaints. Off samples took no photos. These are engine CPU medians as a percentage of one core, not a comparison with the standalone prototype.
• A separate run on 29 October, release engine at 14a08e4, five alternating 30-second pairs with a still slice: median 1.77% of one core on (1.67% to 1.87%) versus 0.80% off (0.67% to 1.03%). It took 15 photos per run and looked windows up 4 times for 83 photos. What limits the added cost is not yet known.
• Compatibility waits for the engine commits to reach the fork's release branch. Native checks do not establish production signed-bundle permission attribution.

Reviewed with sol-loop: 2 rounds with gpt-6.1-sol on high. Sol verdict: approved

Implemented with Claude Opus 5.5. Continued with GPT-6.1 Sol in T3 Code.