fix: use canonical viewport fallback for rootless targeting

[chuanxu742-glitch]

Closes #2120
Refs #1609

Summary

• Prevent a viewport-sized structural ancestor in rootless Android or neutral snapshots from stealing a touch from the smaller semantic target.
• Reuse the contracts package's canonical viewport resolver while preserving the precomputed explicit Application/Window viewport roots.
• Keep the fallback platform-neutral and update existing iOS fixtures to model their explicit Application roots.

Validation

• Planted red on ed26b31: pnpm exec vitest run --project unit-core src/core/interaction-targeting.test.ts failed both new rootless cases because they returned hittable-ancestor instead of overly-broad-ancestor (14 passed, 2 failed).
• Focused green after the fix: 59/59 tests across interaction targeting, selector pipeline, command resolution, and daemon press coverage.
• pnpm run lint passed.
• pnpm run typecheck passed.
• The affected gate passed formatting, lint, typecheck, 161 layering checks, fallow audit, and the full build. Its transitive related-test run was not green on this Windows host: 2178 passed and 63 failed. Sixty failures were host/tooling baseline failures (for example missing zip/yarn, POSIX path assertions, and macOS helper assumptions); the three targeting-fixture failures exposed by this change were corrected and are included in the 59/59 focused green run above.
• Live Android validation was unavailable: adb is not installed on this host. The residual risk is the unverified live RecyclerView interaction path; the missing evidence is a rootless Android helper snapshot plus a tap on the nested semantic target in an available non-user-owned emulator.

Scope and risk

• 8 files touched: one production module and seven test/fixture files.
• Behavior changes only when no explicit Application/Window root exists and the canonical containing-rect fallback identifies a viewport-sized ancestor. Existing explicit-root behavior remains covered.

[thymikee]

Reviewed exact head dcecb3c5cb3046001b41863603b05a8447331ae2 against #2120 and the existing #2122 implementation.

The core policy is correct: resolveViewportRect remains the contracts-owned source of truth, precomputed explicit Application/Window roots are preserved, empty root lists reach the platform-neutral largest-containing-rect fallback, and the focused tests cover Android-shaped/neutral rootless trees plus the matching-rect negative. Coordinator exact-head build passed and the five focused route files passed 59/59 tests.

Two blockers before readiness:

1. fix: use canonical viewport fallback for rootless targeting #2154 competes with open fix: use canonical viewport fallback for rootless touch targeting #2122 for the same issue and owning seam; both claim Closes #2120. Please explicitly choose/supersede one implementation so reviewers are not advancing duplicate branches. The current-base fix: use canonical viewport fallback for rootless targeting #2154 branch is a reasonable candidate, but this needs an explicit dependency/closure decision.
2. resolveRootViewportRect is now only a shallow forwarding wrapper around resolveViewportRect(nodes, targetRect, index?.viewportRootRects). Remove it and call the canonical contract directly at isOverlyBroadAncestor, as fix: use canonical viewport fallback for rootless touch targeting #2122 already does; the wrapper no longer owns policy or reduces complexity.

Readiness evidence is also incomplete: exact-head GitHub checks are not yet available, and live Android proof could not be collected because the sole local emulator (emulator-5554) is actively owned by session a1987 in another workspace. Do not take it over; when an eligible emulator is free, the owed proof is a rootless Android helper snapshot plus a nested semantic-child tap under a broad RecyclerView/structural ancestor.

No other code finding found. Do not apply any label.