feat(rdp): atomically verify native option selections

[abrichr]

What changed

This PR closes the fail-closed OpenEMR/xrdp diagnosis without weakening input verification. It contains four focused commits:

1. Bind opaque-remote identity and target checks to the exact actuation frame.
2. Require direct target evidence before a remote scroll may report readiness.
3. Preserve native typeahead through a capability-gated atomic bulk-text transport seam.
4. Compile demonstrated click -> typeahead -> Enter/Tab gestures as a distinct SELECT_OPTION contract and verify the exact committed value.

SELECT_OPTION is deliberately a new fail-loud IR action rather than optional metadata on TYPE, so an older runtime cannot silently omit the commit. The compiler only emits it for externally controlled RDP/Citrix recordings when the retained frames prove an uninterrupted click/type/commit gesture and exact normalized committed value. It preserves the focusing anchor and identity audit, remaps absorbed risk overrides, excludes parameter pixels from REGION_STABLE, and binds the target surface into compiler provenance.

At runtime, the action:

• rejects an incompatible surface, mode, or backend before acquiring a remote lease;
• re-resolves on a fresh frame before focus;
• re-resolves again after focus;
• delivers typeahead plus Enter/Tab under one input lock;
• treats text/key release failures as delivery-uncertain and never blindly retries;
• waits for one final settled frame, re-resolves without model grounding, and requires exact point readback or exact normalized OCR inside a target-relative readback band;
• rejects ambiguous values such as West Virginia for intended Virginia.

The shared openadapt-types schema and effect re-navigation schema cannot represent this composite contract yet, so both boundaries refuse lossy conversion explicitly.

Why

The retained OpenEMR v25 campaign completed three healthy trials through the remote client and then safely halted at the native State selector in all 3/3 trials. The recorder demonstrated Massachusetts typeahead followed by Enter, but the prior transport emitted one focus-sensitive process per character and ordinary TYPE tried to verify the provisional pre-commit state.

Those are diagnosis runs, not successful qualification evidence. Independent REST plus SQL checks proved no patient write in every trial; observed model calls and silent incorrect success were both zero. The campaign must be rerun after this candidate is merged and released before any success claim.

Validation

• Exact base: 2be33278f41a5dc232133da515ae3bebbe8656bb
• Exact reviewed head: 6188d6e4b4d8152be57f7bfecfbc52674057df44
• Stable patch IDs match before/after the conflict-free rebase
• Independent adversarial review: no high/medium finding
• Focused local gate: 270 passed, 1 skipped
• Broad remote/compiler/policy/schema gate: 599 passed, 1 skipped
• Independent post-rebase receipt/compiler gate: 112 passed
• Ruff and diff checks pass
• Retained v25 recording compiles to 33 steps with four SELECT_OPTION actions, including State step_024

No live campaign was restarted, no provider resource was enabled, and no provider spend occurred.

Merge boundary

Keep this PR unmerged until the v1.25.1 publication guard has cleared. After merge and exact-main CI, publish the patch candidate, then rerun the countable OpenEMR 3+3+3 qualification campaign from the retained recording.

[abrichr]

Release-candidate coordination: please keep reviewing and fixing this PR, but do not merge it until v1.25.1 is published and independently verified. The exact patch candidate is main@2be33278f41a5dc232133da515ae3bebbe8656bb; merging this feat before publication would change the authorized semantic release from patch to minor.

[abrichr]

Release sequencing update: v1.25.1 has been published and independently verified (tag/release commit lineage, GitHub/PyPI byte-identical artifacts, archive boundary checks, and both attestations). The temporary publication hold is lifted; resume normal review and merge sequencing from current main.

[abrichr]

Coordination update: exact head 9b1217c must not merge. Required Citrix and Docker-RDP qualifications returned accepted=false. Independent review confirmed the preserved visual-anchor-vs-field-region correction (dirty-diff SHA-256 04566ac3bc74be077b5c5ec79f2359b59b8c6613b428390251638ca4d3491dad) is necessary; add the compact visual anchor -> unanchored TYPE regression and rerun both remote gates. PR #288 has now merged as current main f133bbd, so rebase the corrected candidate there before the single authoritative rerun. The superseded main CI was canceled to stop paid long jobs.

[abrichr]

Ownership update: Codex is resuming #291 in a fresh isolated clone from exact Git objects. Do not push, clean, reset, or reuse the dirty shared worktree. I will preserve the reviewed 04566ac3 correction, add the required compact-anchor/unanchored-TYPE regression, rebase onto current main f133bbd, then run one authoritative matrix.