feat(#37): CDP DOM-read verification path for React/div-soup robustness

[CameronCrow]

Closes #37 (investigation + first slice; remaining slices scoped in the doc).

What this is

React/div-soup apps expose thin a11y trees, so structural verification has
little to assert on even though the app renders fine. This PR investigates
touchpoint's CDP seam as the way to close that gap, documents the findings +
a scoped plan, and ships the one safe, small, fully-testable slice.

CDP findings (verified against touchpoint source)

• Touchpoint's CDP backend has a source="dom" path that injects a JS DOM
  walker via Runtime.evaluate and walks the actual live DOM — not the a11y
  projection. A role-less <div>Total: 42</div> with no ARIA becomes an element
  named "Total: 42"; shadow DOM is traversed; aria-hidden subtrees dropped;
  get_text_content reads live textContent/value. This is exactly the
  content a thin React a11y tree omits.
• Touchpoint's windows() replaces a CDP-owned PID's native window with the
  CDP page-target window (cdp: id, browser main PID), so a Cyclaudes handle
  for such an app already carries the CDP id — no extra plumbing.
• It fits the ui.py discipline cleanly: owned-only via PID (CDP window pid +
  is_owned ancestry), re-resolve fresh (the DOM is re-walked every call), and
  abstain honestly (touchpoint raises TouchpointError when not CDP-backed).

What CDP does NOT solve (in the doc, honestly)

Non-Chromium React (React Native, WebKit/Gecko webviews), apps not launched with
--remote-debugging-port, canvas/WebGL content, native div-soup, cross-origin
iframes. Where none apply, the honest answer stays: abstain + tell the dev to add
ARIA/data-testid hooks. Never a silent pass.

Shipped slice

• DomUnavailable(UIError) — new abstention condition (CannotVerify outcome).
• WindowHandle.read_dom_text(query) — read-only DOM-text reader through the
  full discipline; abstains, never false-passes when the target isn't a
  readable CDP-backed DOM; ordinary ElementNotFound when the DOM is readable
  but the query is absent.
• _resolve refactored to share _match between the AX and DOM paths; AX
  behavior unchanged.

Fake-driven tests in tests/test_ui.py::TestDomRead (9 tests). Full suite green
(242 passed, 6 live deselected). The one thing fakes can't prove — a real CDP
DOM walk returning div-soup content — is deferred to the live acceptance slice
(needs a running Chromium React sample), scoped in planning/REACT_ROBUSTNESS.md.

Deliberately NOT built (scoped as slices in the doc)

Settle/retry + DOM-sourced assert_* (slice 3), and app_session launching
targets with --remote-debugging-port (slice 4). Kept out to keep this slice
small, safe, and provable; a false-pass on a React UI would be worse than an
honest "not supported yet."

🤖 Generated with Claude Code