feat(quick): handler-coverage gate and read-only surfaces (#231 PR 1)

[mberrys]

Epic #231 restores Quick GUI coverage for the retired Widgets surfaces in three PRs. This is PR 1: the contract-level handler-coverage gate plus the read-only and presentation surfaces (measure, select/copy/capture, soft proof and separations, settings and diagnostics, and the display half of the production colour modes). PR 2 brings the direct mutations and PR 3 the governed Fix and publication operations; both stay on this branch as their base.

The gate is docs/shell-handler-coverage.json plus the handler-coverage ratchet in scripts/verify-command-catalog.py. The descriptor availability flag is the handler gate CommandCatalog enforces, so the ratchet reads availability rather than string mentions: every KEEP or ABSORB action must be implemented or recorded, the recorded set must match exactly (a new unbound action fails, and so does a baseline entry kept after its handler lands), and --record-ratchet rewrites the baseline from the contract. The first run recorded 70 gaps on dev at b08e218; this branch ratchets the baseline to 51 and it can only move down. Negative-case tests in scripts/ci/test_command_catalog.py prove each rule can fail; the check runs as its own step in ci.yml's source_integrity job and as whole-tree evidence in scripts/agent/check-change.py, and docs/LOOP_SHELL_CONTRACT.md documents it.

The surfaces on top: Measure and text selection join the closed InteractionTool vocabulary as their own interaction kinds, producing a revision-fenced Measurement in production units that never becomes a DragSession and a revision-fenced TextSelection resolved through Core's text layout in reading order, with nine bound commands, screenshot and image extraction through the atomic writer, and a text/no-text-layer refusal instead of an empty copy (#238, #232). The five actionColor* display modes are presentation-only filters over admitted surfaces, converted with Core's own converter, marked as simulations by the fidelity indicator and never reachable as production evidence; soft proof renders through a local LittleCMS proofing CMS behind its own surface identity with profile-missing and profile-invalid as visible states; plates carry show/hide/isolate state over Core's separations with a real ink-coverage readout (#235 display half, #237). The shell gains one typed settings store with confirmed reset-to-factory, the settings/render-option/diagnostics commands developer-gated, the ADR-006 bundle from Core's collector, the five KEEP render options reclassified ADVANCED with rationale, and manifest-driven menu routing (#239). The absorbed signature-plugin and scanner-plugin product-surface rows keep their reviewed null follow-ups (both have delivered replacement surfaces, which the epic's acceptance permits) so they stay in parity with the G00 source register; re-homing them would amend reviewed governance data and is left to the register owner.

Validation: check-change.py --base origin/dev passed at the head SHA — 112/112 checks across build_policy, documentation, interaction and quick, with the 24 mapped suites built and run in the worktree build, clang-tidy over every changed translation unit, and the catalog/ratchet/mirror-parity/source-integrity/architecture/product-surface checks green. The three surface workstreams each ran their focused suites green before integration and reported their evidence. One EditorHost ctest lane flaked during two earlier gate attempts; both modes were root-caused to the environment rather than the diff — a leftover recipe in the shared QStandardPaths qttest directory written by a concurrently running worktree session (proven by a deterministic repro: clean directory 54/54 pass, one leftover file reproduces the exact failure) and, separately, an empty-output non-zero exit with no crash report, the signature of an external process kill while another session frees build file locks; both are recorded as #265. CI runners are clean, so the hosted gate is unaffected. Limits: no native-GPU smoke (headless offscreen + software backend only), no release-profile build locally, and the pwsh/WSL-dependent CI lanes are absent on this host.

Quality review: the slices reuse Core's own text layout, colour conversion, CMS and diagnostics machinery rather than inventing parallel semantics; the display filter is confined to the scene-graph upload path so it cannot leak into a surface identity; and every unfinished piece (isolated-plate pixels and the reference-separation comparison for #237, keyboard-only measurement placement for #238, and actionRendering_Errors/actionMagnifier/actionGetSource staying declared for #239) is reported as a gap rather than dressed up as done.

Advances #231 — the contract gate and the first surface group are in place; the epic closes when the ratchet reaches zero in PR 3.
Advances #232 — text selection, reading-order copy, capture and extraction are bound and tested, including the host-level refusal to overwrite an existing file; the screenshot write shares that same atomic writer and policy.
Advances #238 — the measure tool, production units and revision fencing are tested; keyboard-only placement of a measurement is not implemented.
Advances #237 — soft proof, plate state and the ink readout are real; isolated-plate pixels and the reference-separation comparison remain open.
Advances #239 — all four acceptance bullets are covered by tests; actionRendering_Errors, actionMagnifier and actionGetSource stay declared pending their layers.
Advances #235 — the display colour modes are complete; bleed fixup, bitonal document creation and render-to-images belong to PR 3.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}