Implement per-(native-desktop-GUID x monitor) layout partitions

## Problem / goal

Implement per-(native-desktop-GUID x monitor) layout partitions so each native Windows virtual desktop the user visits is tiled with its own independent state.

## References

- `DESIGN.md` §4 (Native-desktop coexistence paragraph) — an independent, persistent layout tree per (native-desktop GUID x monitor); desktop GUIDs learned lazily via `GetWindowDesktopId`; known limit — an idle desktop switch with no windows on either side emits no events, so the active partition can lag until the next event or heartbeat sweep, accepted and documented; optional feature-flagged native-desktop-switch passthrough via `SendInput` Win+Ctrl+Arrow.
- Depends on the v0.2 workspace issue (extends its single-native-desktop assumption to multiple).

## Acceptance criteria

- [ ] Bastion maintains a separate layout-tree partition keyed by `(native desktop GUID, monitor identity)`, learned lazily (no desktop enumeration exists to pre-populate this).
- [ ] Switching native desktops (inferred per DESIGN.md §4's cloak-burst heuristic, already implemented as part of workspace support) selects the correct partition without cross-desktop state bleed.
- [ ] The documented idle-switch lag (no events fire, partition catches up on the next event or 5s heartbeat) is accepted behavior, not treated as a bug — a test demonstrating the heartbeat eventually corrects a stale partition is sufficient coverage, not an attempt to eliminate the lag.
- [ ] The optional `SendInput` Win+Ctrl+Arrow passthrough is implemented behind an off-by-default feature flag, labeled best-effort (no-ops if rebound; eaten by UIPI under an elevated foreground window).

Start with DESIGN.md §4 and the existing workspace support that implements the cloak-burst heuristic. Trace how native desktop GUIDs are obtained through GetWindowDesktopId and how the 5-second heartbeat updates state. Done means independent layout trees per desktop and monitor, heartbeat recovery of stale partitions, and an off-by-default best-effort SendInput passthrough.

Written by the indexing model from the issue text.