[coneilen]

Summary

Fix the action-only launcher gate so every contained GraphCode/zmx target is released only after an immutable numbered journal publication binds its held launcher generation and job. Add the final bounded W1-W6 action path using sealed qualified layouts instead of replaying already-qualified setup actions.

Changes

• create a dedicated numbered journal for action-only runs and reject null, unpublished, foreign, or empty-path states before gate release
• preserve exact process/job custody, cleanup reserve, held kernel exit, stream EOF, and zero-survivor release evidence
• copy and hash-bind the qualified Split Right, final-tab, many-first, hover, and agent/Shell topologies into fresh owned action fixtures
• seed all persisted shell sessions inside one contained job, run only W1-W6, and permit one W6 action-result image
• record shell-computed nonce/PID/arithmetic focus proof and real native pointer coordinates

Test plan

RED: pwsh -NoProfile -File Tools\windows\Tests\UiCaptureDriver.Tests.ps1 -ScratchRoot D:\gcr\red-full-90b49aa1 -PrebuiltFixtureManifest D:\gcr\fixture-42d65e80\fixtures.json -PrebuiltFixtureManifestSha256 0F04B1026244B31E574659A4493D84249C8ECD8F13378516E9F6858EDC22453F -> 177/182 passed; null action journal was rejected by parameter binding and action publication wiring was absent
GREEN: pwsh -NoProfile -File Tools\windows\Tests\UiCaptureDriver.Tests.ps1 -ScratchRoot D:\gcr\green2-full-192bdcd1 -PrebuiltFixtureManifest D:\gcr\green2-fixture-8dc89b9f\fixtures.json -PrebuiltFixtureManifestSha256 449C8DFD52D75C5B69A66A9FFBAD9F56D9341743196480B05CB0919B187DB20D -> 182/182 passed with zero failures and zero skips
REGRESSION: pwsh -NoProfile -File Tools\windows\Tests\UiCaptureDriver.Tests.ps1 -RequireRealSeed -RealSeedZmxPath C:\gca-providers\zmx\zig-out\bin\zmx.exe -RealSeedZmxSha256 447B8E94FE5A72D0B7D0F8C614BBEFDE597DFB864FD38278DB53AE98A921EC0B -ScratchRoot D:\gcr\real185-35d677ab -PrebuiltFixtureManifest D:\gcr\green2-fixture-8dc89b9f\fixtures.json -PrebuiltFixtureManifestSha256 449C8DFD52D75C5B69A66A9FFBAD9F56D9341743196480B05CB0919B187DB20D -> 185/185 passed with zero failures and zero skips

• pwsh -NoProfile -File Tools\windows\Tests\ValidationRunner.Tests.ps1 -> PASS; nested UiCaptureDriver 182/182
• pwsh -NoProfile -File Tools\windows\Tests\Hardening.Tests.ps1 -> repeated deterministic hardening 3/3 passed
• PowerShell parser over six changed scripts -> 6/6 passed
• git diff --check and git ls-files --eol -> passed; all touched tracked files are LF

Checklist

• I have read the Contributing Guidelines
• I have signed off my commits (git commit -s) per the DCO
• Tests pass locally (make test)
• Code follows the existing style (make check)
• I added the test/contract before the implementation and observed the intended RED failure