Capture: window-scoped recording fails with 'missing ordinal' after input to another window is dropped #1976

Window-scoped recording (--window on macOS, Windows, and Linux X11) fails at stop with:

sealed native source journal has a missing ordinal

Cause. Every native input reserves a source ordinal when it arrives. When the input did not go to the target window (for example pointer_over_other_window, or the release of a press that was already dropped), the recorder drops it on purpose and the journal skips that ordinal. Nothing records the skip, so the sealed journal has a hole. The verifier requires 1..last_source_ordinal with no holes and correctly refuses the recording. Any click in another window during a window-scoped recording therefore makes the whole recording unusable.

A second trigger on macOS: the Quartz window list can include full-screen system windows above document windows, such as the Dock (layer 20) and Notification Center (layer 23). They are mostly click-through, but MacOSInputFocusProbe.window_at treats them as the topmost window at every point. Clicks on the target window are then dropped as pointer_over_other_window, which also hits the error above.

Close:

1. When the recorder drops input by policy, record the skipped ordinal and its reason in a sealed artifact. The verifier accepts a skipped ordinal only when it is recorded there, its reason is a known drop reason, and the recording is window-scoped. A hole with no record (a crash or a bug) still fails.
2. On macOS, don't let system window layers at or above the Dock level count as the window under the pointer unless real hit testing (Accessibility) shows that their process takes the click there. When that can't be determined, fail closed. Other apps' windows keep blocking as before.

Test: unit tests for the verifier (recorded skip accepted, missing record still refused, unknown reason refused, skip over a real event refused). An end-to-end record() test that clicks another window, seals the capture, and validates it. macOS probe tests with a full-screen Dock and Notification Center window over the target.

Blocks the "input in the other window" check for #1867.