fix: reject ordered-out windows during app discovery

[CoolJosh0221]

Summary

Reject WindowServer records that are explicitly ordered out before app discovery uses them as evidence that an AX window has a visible CG peer.

This prevents a closed or invisible Electron window retained by AX and WindowServer from being rediscovered and reinserted into a tiled layout.

Reproduction

1. Tile several windows, including Vesktop.
2. Close Vesktop's visible main window while leaving the process running.
3. Open and dismiss a context menu in another managed window.
4. Compare rift-cli query windows before and after.

In the captured reproduction, the before query had four legitimate windows. The after query re-added the same pre-existing Vesktop identity (WindowServer ID 121366) as a non-floating tile at x=1368, displacing the Code column from x=1368 to x=2276. This was a retained identity, not a newly created user window.

I reproduced this on the preceding fork build and confirmed that the patched build stopped this sequence from creating the ghost tile.

Root cause and fix

State::visible_window_server_info_map correlates an application's AXWindows with an ID-targeted WindowServer query. That query can return a retained WindowServer record after a window is ordered out.

Previously, every returned record entered the visible-peer map. has_visible_cg_peer accepted it, refresh_visible_windows included its WindowId in known_visible, and downstream discovery could re-admit it. Existing stale cleanup consults ordered state, but cannot help when positive discovery labels the same record as visible again.

The patch checks window_ordered_in for each returned record. Explicit Some(false) records are excluded and traced; Some(true) and inconclusive None remain eligible. A failed private query during WindowServer/display churn is not treated as proof that a legitimate window disappeared.

This runs only at existing discovery boundaries. It adds no polling, application-specific exception, or geometry threshold.

Tests

Added retained_ordered_out_record_is_excluded_from_visible_map, which verifies map membership for Some(true), Some(false), and None ordered-state results.

Local verification on macOS after rebasing onto 74ce00d:

cargo +nightly fmt --all --check --verbose  PASS
cargo check --locked                         PASS
cargo test --locked                          547 passed, 0 failed

Related work and scope

• fix: Some applications' (Microsoft Word) closing event not detected #372 refreshes discovery after an AX destruction notification. This change handles a different case: the AX identity and an ID-targeted WindowServer record both remain available, but the WindowServer record is explicitly ordered out and must not count as a visible peer.
• Tiles get reserved for windows that aren't visible while streaming/screen recording #436 and closed fix: ignore screen capture helper windows #438 concern live streaming/screen-capture helper surfaces. This PR does not claim to fix or reproduce that path.

AI assistance: Root-cause analysis, implementation, regression-test development, and PR drafting were performed with OpenAI Codex assistance. I supplied the reproductions and manually validated the patched build.