fix(desktop): capture same-origin iframe annotations reliably

[lastobelus]

Picking inside a same-origin iframe preserved the annotation but could lose its screenshot. The desktop passed a rectangle in page CSS pixels directly to Electron's native crop API. In a zoomed guest, that can select the wrong area, truncate the image, or fail with UnknownVizError.

Capture the complete guest surface, then map the CSS rectangle into the image before cropping. Preserve fractional coordinates until image rounding, clip iframe selections to their surrounding scroll panels while respecting positioned containing blocks, and retain the existing annotation delivery, cancellation, and screenshot failure fallback. No IPC schema or security settings change; cross-origin picking remains unsupported.

Validation: 169 focused tests, scoped desktop typecheck and lint, plus the actual Template Editor in an isolated Electron webview using the production picker and capture helper. Native capture passes for a normal Facsimile selection, iframe scrolling, and surrounding-panel scrolling. The synthetic native regression reproduces UnknownVizError with the former crop call and verifies the fixed PNG contains the selected target. Existing Chromium picking, frame navigation, cleanup, and annotation packaging checks pass.

The installed app reproduced the original warning. It has not been modified or restarted; corrected native capture was verified in the isolated runtime. Template Editor evidence remains private; public evidence uses a synthetic same-origin iframe.

CI repair: the mobile cold-highlighting comparison freezes and restores its clock so Shiki’s tokenization budget cannot make identical input produce different token boundaries under runner load. Production mobile behavior is unchanged; all five focused highlighting tests pass.

Implemented with GPT-6 in the Codex harness.