[0.2.0] Add GUI and end-to-end automated test coverage for the operator loop

[mberrys]

Part of #155.

Problem

Nothing tests the application. UnitTests/ holds 22 test files and every one exercises the core, the CLI, or a plugin's non-GUI logic. There is no QTest::mouseClick, no QTest::keyClick, no qWaitForWindowExposed anywhere in the tree.

The consequence is that the primary sellable surface — the Editor operator loop — has no automated coverage at all. docs/v1-operator-acceptance.md is a 90-line manual checklist, and R-004 in the readiness audit resolves an orphaned-process risk with "Manual checklist item 12". Every release therefore depends on someone running that list by hand, and every regression in the shell is found by a human or not at all.

This is disproportionately risky given what is queued. The epics in flight — interaction quality (#139–#146), multi-document, undo redesign, colour-managed canvas, comments panel — are all GUI-layer changes to a shell with zero automated coverage. #146 is chartered to automate interaction-performance traces; it needs a harness that can drive the application, and that harness does not exist.

The gap is also visible in §5 of V1_RELEASE_READINESS.md lists every local validation command as Blocked ("no Qt/vcpkg in cloud VM"), with CI as the only authoritative validation. CI runs ctest, which runs core tests only.

Scope

1. A GUI test harness that can launch the Editor offscreen in CI, load a document, drive input, and assert both UI state and document state. Offscreen or virtual-display execution on Linux and Windows runners.
2. End-to-end coverage of the V1 operator loop, converting docs/v1-operator-acceptance.md from a manual checklist into executed tests: open → preflight → navigate to a finding → apply the fixup → preview → save as new output → revalidate → confirm source unchanged by digest.
3. Coverage of the failure paths that the manual checklist covers today and that are easy to regress: cancel a running preflight, close during a long operation, missing PdfTool in the bundle, corrupt document, permission-denied output path.
4. Visual regression on a small, deliberately-chosen set of canvas states — page render, overlays, separation preview — with a stable comparison method and a documented tolerance. Kept small on purpose; a large screenshot suite becomes noise.
5. Wire into ci.yml alongside the existing ctest targets, with artifacts (screenshots, logs) captured on failure.
6. Flake policy: quarantine mechanism and a rule that a quarantined test is either fixed or deleted within a defined window. A GUI suite nobody trusts is worse than none.

Acceptance criteria

• The full V1 operator loop runs headless in CI on both Linux and Windows and fails the build on regression.
• Every item in docs/v1-operator-acceptance.md is either automated or explicitly marked as requiring a human, with the reason recorded.
• Cancellation and close-during-operation paths are covered, including the orphan-process case behind R-004.
• Test artifacts on failure are sufficient to diagnose without reproducing locally.
• The harness is usable by [0.2.0] Automate interaction-performance regression traces #146 for interaction traces without modification.
• Suite runtime is bounded and documented so it can run on every pull request, not only on master.

Test strategy

This issue is test strategy, so the acceptance is meta: the suite must catch a deliberately-introduced regression in each covered path. Validate by injecting faults — break finding navigation, break the save-as-new-output digest guarantee, break cancellation — and confirm the suite fails for each.

Dependencies

• Run CI for pull requests and execute Qt tests on Windows #79 (closed) — run CI for pull requests and execute Qt tests on Windows; this extends that surface.
• [0.2.0] Automate interaction-performance regression traces #146 — interaction-performance regression traces; consumes this harness.
• [P2] Performance validation: zoom + automation diagnostic tests #115 (closed) — historical performance validation; not reopened.
• Coordinates with the multi-document and undo issues in this epic, whose acceptance criteria assume a harness that can drive the shell.