macOS: implement KeyEmitter::release_modifiers (chord-accepted suggestions can misfire)

[vstrelnikof]

KeyEmitter::release_modifiers (added in 0.6.0 for the suggestions feature) has a default no-op implementation, and the macOS emitter inherits it.

Consequence: accepting a spelling suggestion with Ctrl+Shift+<digit> can misfire on macOS — the user's physically-held modifiers aren't neutralised before the replacement text is emitted, so the retyped characters can come out modified (or trigger app shortcuts) depending on timing.

What's needed: post the appropriate flags-clearing / modifier key-up events via CGEvent before emitting the replacement, mirroring what the evdev and Windows emitters do, and make sure the synthetic events are stamped as injected (the stamping mechanism from 0.6.2 already exists) so the listener ignores them.

Where to look: crates/poltertype-input/src/macos.rs (emitter side), and the trait definition in poltertype-input for the contract. Testable on hardware with any two-layout setup: trigger a suggestion tooltip, accept via the chord while still holding the keys sloppily, watch what lands in the text field.

[vstrelnikof]

Implemented in PR #17 — and the fix turned out to be in two halves, only one
of which this issue anticipated.

One correction to the issue text: Windows did not already do this. It
inherited the same default no-op as macOS and had the same bug. It now sends
key-ups for both sides of each held modifier via SendInput.

On macOS the decisive half was not release_modifiers at all. An event
built from a HIDSystemState source inherits the live hardware modifier
flags, so with the accept chord still held our backspaces went out as ⌘⌫ —
"delete to start of line", which wrecks considerably more than the word. The
emitter now clears the flags on everything it posts, which needs nothing to
have worked at the OS level and covers the case where the engine did not
think anything was held.

release_modifiers itself is there too: macOS has no key-up for a modifier,
so each release is a FlagsChanged event carrying the picture that remains
down. Caps Lock is deliberately excluded — it is a latch, and clearing it
would turn the user's Caps light off behind their back.

It fires at the right moment because of #4: the tap now subscribes to
FlagsChanged, so held_modifiers is accurate between keystrokes instead of
only refreshing when an ordinary key arrives.

Untested on hardware. Compiled by CI, executed by nobody — the shape of
test that would catch a mistake here is a Mac and a two-layout setup, per #3.