feat: DEC line drawing, modified wheel, Screen equality, history notes

[vyncint]

Closes ten of the twelve open items of the v0.8 milestone. The two that
are not code changes here — #146 (styled history) and #147 (addressing
history) — are design questions, and each gets a written decision in its
issue once this lands rather than a half-built feature in a release.

DEC Special Graphics is translated (#179)

ESC ( 0 l q q q k is ┌───┐, and the grid used to say lqqqk. That is how
every ncurses application draws its borders (smacs/rmacs on an xterm
terminfo are exactly ESC ( 0 / ESC ( B), so the crate's own promise —
assert on what a user would see — was wrong for a large class of programs,
and wrong in the worse direction too: a snapshot that had blessed lqqqk kept
passing after the border broke.

vt100 drops the designation entirely (ESC ( 0 reaches unhandled_escape),
so the sequence tracker now holds the G0/G1 designations and the SO/SI
locking shift, and the emulator asks it, byte by byte and before stepping,
whether a byte draws as a glyph. If so the glyph is staged in place of the byte
and both parsers receive the staged stream — rewriting before either parser is
what keeps the primary and the attribute shadow the same shape, exactly as the
SGR rewrite does, and the shadow's correspondence check runs on every snapshot.
A stream that never designates a set takes the old slice-through path and pays
nothing.

Scope is stated rather than implied, in the README, DESIGN.md and the
CHANGELOG: G0/G1 and the locking shifts only; one set translated; other
designations read as ASCII; G2/G3 and single shifts not modelled; RIS returns
both sets to ASCII; DECSC/DECRC do not save charset state. An OSC 8 label
written in the graphics set records the glyphs, since the label is what a
reader sees.

Terminal::scroll_with (#174)

Scroll::{ctrl, alt, shift} and a ScrollChord type, mirroring
MouseButton/MouseChord; scroll is now the unmodified case of it, as
click is of click_with. The wheel gets a chord type of its own rather than a
wider MouseChord so a wheel direction cannot be handed to click_with — a
notch has no release, and the type keeps that from being a runtime surprise.
The form-echo fixture now names mouse modifiers, so Ctrl-wheel is proved
through crossterm's parser and not only through our own table.

Screen: PartialEq + Eq (#183)

Equality is the same observation, counters included, and the doc says so —
along with the trap it replaces: comparing to_string() is style-blind.

Waits name scrolled-off history (#203, the diagnostic half of #147)

wait_until and wait_frame errors, on both the timeout and EOF paths, say
how many rows have scrolled off the top and point at Screen::full_text. The
note is conditional on purpose: the predicate is an arbitrary closure, so the
wait cannot know what it was looking for — only what is true. Silent when
nothing has scrolled. contains and find say where they stop.

resize after exit is refused (#202) — behaviour change

The same Error::Write as send, on the same evidence (EOF). It used to
succeed and the snapshot then reported a size no application ever rendered at.
Listed under Changed. No existing test resized after wait_exit.

The rest

• Bitmap::colours is quadratic, so a real screenshot takes seconds #201 Bitmap::colours is linear (HashMap), ties ordered by first
  appearance on purpose and documented. The timing is not asserted — the issue
  is right that it would flake — but the 512x512 all-distinct case is in the
  suite, and it ran in about 8 s quadratic against milliseconds now.
• Scrollback is not reflowed by a resize, and the stale geometry is silent #148 documented as a decision on resize and scrollback_text, with the
  alternative (discard history on resize) rejected in writing; the two-width
  case is pinned in a test.
• Two doc comments still name Error::Input for what is now Error::Size #198 three doc links, not two: spawn's # Errors had the same wrong
  variant.
• The README mirror does not compile-check its insta::assert_snapshot! line #200 the README mirror snapshots with insta::assert_snapshot!; the
  blessed file was read against the hello-tui snapshot before acceptance
  (identical grid). It needs no cfg(feature = "insta"): insta is a
  dev-dependency and is present in every feature configuration, which the
  --no-default-features job now proves.
• CONTRIBUTING's "full suite" runs 16 fewer tests than CI, and omits the other gates #199 CONTRIBUTING's first command is the real full suite, and every CI
  gate is listed inline with ci.yml named as the source of truth.
• SECURITY.md claimed the crate has no unsafe. It has two blocks —
  dup(2) and kill(2) — both audited FFI. The policy now says that.
• cells_between uses i64: bounded by its callers today, but d * steps at
  u16::MAX overflows an i32, and a helper should hold its own bound.

Verification

fmt · clippy -D warnings in all three feature configurations · 360 tests
all-features, 340 no-default-features, 358 decode-only (337 on main)
· docs -D warnings, default and all-features · cargo deny · MSRV 1.85 with
--locked --all-features · cargo-semver-checks against the published 0.7.0:
no semver update required (every API change is additive).

Every new guard was mutation-checked — removed in turn, its test went red,
file restored from the commit: charset translation off, SO ignored, RIS
keeping the graphics set, the history note silenced, resize accepting a
departed child, wheel modifiers dropped, and the colours tie order reversed.

What the stress workflow found

The first stress run on this branch — 100 iterations, ten shards — went 9 of
10 green. The ubuntu/8-thread shard failed on its first iteration in
mouse_events_outside_the_grid_are_refused: a resize followed at once by
Esc, and the fixture never exited. That test landed in #177 after the last
stress run, so it had never been stressed. It reproduced locally at about one
run in forty.

The cause is in crossterm's event reader, and a real terminal has the same
race. When its poll reports the tty and the SIGWINCH fd in the same call,
the signal arm returns the Resize event at once, abandoning the tty
readiness it was handed — and mio registers edge-triggered (EPOLLET,
EV_CLEAR), so the Esc already in the queue is never offered again until
more input arrives. The application blocks in read() with the keystroke
behind it.

Fixed in the second commit: form-echo acknowledges a resize on its last:
line, the test waits for that frame before sending Esc, and
Terminal::resize documents the trap so a user's own test does not walk into
it.

…and then a real bug in resize

The second stress run went 9 of 10 again, now failing at 16 threads on
iteration 21 — at the new wait_frame for the acknowledgement. The error was
telling: the live screen showed last: resize:18x4, so the fixture had
repainted, yet the wait reported no repaint since the cursor. resize sent the
SIGWINCH first and took the frame cursor afterwards; a fast application's
acknowledging repaint could complete, and be counted, in that gap — so the one
frame the wait had been promised sat behind the cursor. The doc's guarantee
("only a frame completed after the resize can satisfy the wait") was inverted
by the ordering. Worse, such a frame was rendered into the old grid and then
clipped.

Fixed in the third commit: the grid is resized and the cursor taken before
the ioctl, all under one state lock, so no byte is processed between the two
steps; if the ioctl fails the grid is restored so kernel and grid never
disagree. A new test in frames.rs resizes three times and requires each
acknowledging frame to be offered and to carry the new size. Listed under
Fixed in the CHANGELOG — this one affected users, not just our suite.

Verified with 40 iterations each of the input and frames suites and 12 of the
whole workspace, all at 16 threads, no failure — and the stress workflow is
running again on the final commit; the release PR will cite that run.