fuzz: arm the terminal in morph, and hold it to one switch per chord

[deblasis]

Follows #758, now merged, and rebased onto it.

#758 made morph report a run that switched nothing. This is why it was switching so little.

morph sent its layout chords into an unarmed XAML island. The island drops synthesized keys until a real click lands on its own pixels, and #752 fixed that for the mouse-fuzz harnesses without reaching this one. The cost was invisible because nothing measured it: the harness kept sending, the app kept ignoring, and the oracle only ever read what did happen.

Measured against a clean build it converted 38% to 52% of the chords it sent - 13, 14 and 20 of 34, and 16 of 31. Run outside the suite, which minimizes other windows first, it reliably converted none at all: the startup probe reached a window that had never been clicked and traced no switch whatsoever.

So arm before every chord, the same shape as Enable-Chords in mouse-fuzz-tab-close-selection.ps1. Three quarters across and down lands in the terminal under either layout; the window center only does while the strip is narrow, and this harness spends its run changing that. The ad-hoc re-arm click the tab-color branch already carried becomes a call to the same helper.

What the floor can now say

seed	chords	begins before	begins after
1337	34	13, 14, 20	49, 50
4242	26	probe traced nothing	39
777	31	16	51

1.44 to 1.65 switches per chord, so $MinBeginRatio moves from a third to one: every layout chord begins a switch. The surplus above 1 is chords that arrived mid-switch, held as _pendingLayoutTarget in MainWindow.AnimateTabLayoutTo and replayed on completion.

The margin is the surplus and it is not guaranteed - two chords inside one switch share the single pending slot, so the second is lost - which is why the floor is exactly 1 rather than something above it.

The tail settle had to change with it

Three times as many switches means the last one is far more likely to still be in the air when the finally kills the process, and the verdict reads the trace afterwards. A fixed 1200ms started reporting a begin with no end as switch begin/end mismatch ... (a switch never finished) - a false exit 2. It polls for balance now, which also returns sooner than the sleep did in the ordinary case.

Validation

check	result
just fuzz "-Only morph"	pass, exit 0 - 34 chords, 50 begins, 50 ends, floor 34
just fuzz-selftest	SELFTEST OK, exit 0
just fuzz-list	exit 0
three seeds through the suite	49/34, 39/26, 51/31, all balanced, all pass

It also passes on the first attempt now. Every earlier suite run needed the retry, because the first attempt failed the startup probe.

Noticed, not addressed

The trace shows consecutive SWITCH begin vertical=True pairs with no end between them, so the app can animate a switch to the layout it is already showing. AnimateTabLayoutTo guards on _verticalTabsVisible == vertical at the OnConfigChanged call site but not on the _pendingLayoutTarget replay path. It is benign - ghosts=0 throughout and every begin is answered - but it is a 340ms animation and a morph cycle for a no-op. Worth its own look, not this PR.

Review round

Reviewed at high effort before merge; three findings, all fixed in fuzz: measure the morph floor against the chords that landed.

• The floor divided by every chord attempted, including ones Chord() refused and never delivered. Harmless at the previous ratio of a third; at one it charges a foreground steal to the build and reports it as "the router never saw them" about chords that were never sent. It divides by the delivered ones now, which is only safe because the miss cap above has already rejected a run that lost most of them.
• Enable-Chords throws where the click it replaced was best-effort, and it sat inside the tab-color try/catch - so a refused arming click landed as one more tab-color-error and left the island unarmed, with the iterations after it sending chords nobody handled. Hoisted out of the catch.
• Rect swallows GetWindowRect's return, so a window that had gone away came back as zeros and aimed the arming click at the top-left of the screen, reporting a foreground miss for a window that no longer existed. Checked before it is measured, and reported as PRODUCT_FAIL to match the caller's own convention.