Harness: pointer injection (wlrctl) for direct interaction checks

From #82's pushback: wtype is keyboard-only, so interaction checks (the #77 view-hold, hover overlays, scrubber drags, drag feel) are representative rather than direct. cage exposes wlr_virtual_pointer_manager_v1 already; wlrctl (one apt install, owner action) or ~100 lines of wayland-client would give the harness real pointer injection. Also from the same pushback: two state-ownership bugs in a row suggest the cheapest next instrument may be a headless driver for the shell's update/view rather than more pixel checks - evaluate both when this is picked up.