[Plastic-time]

Desktop.get_state() reads the cursor before querying virtual desktops and walking the UI tree. If the pointer moves during that work, Screenshot and Snapshot return the earlier position. An annotated capture also marks the earlier position, and a region capture can incorrectly include or omit the cursor when it crosses the region boundary.

Move the cursor read after desktop collection, tree traversal and region filtering, just before screenshot capture. The response and annotation share that reading, with region clipping applied to the new position.

Related to #505. This reproduces stale coordinates caused by movement during collection; I have not reproduced the report's exact external SetCursorPos/HTTP sequence. GetCursorPos is already called on every request, so this change addresses sampling order rather than a cross-request cache. It does not make cursor sampling and image capture atomic.

Validation on Windows / Python 3.14.8:

• All 12 new regression cases fail on unchanged upstream 92a649b and pass with this change. They simulate movement during virtual-desktop queries or UI-tree traversal and cover clean/annotated screenshots, visual/text snapshots, and entry into or exit from a capture region. Windows input and screen capture are mocked; the tests do not move the real pointer.
• Screenshot-related tests: 111 passed.
• Full suite: 1,351 passed, 6 skipped, with 5 dependency deprecation warnings. The skipped tests require Windows symbolic-link privileges. Run with NO_PROXY=* and a workspace-local --basetemp whose parent exists.
• Ruff lint passes for both changed files; the new test file passes Ruff formatting; git diff --check passes. The service module has a pre-existing formatting difference outside this change.

[Jeomon]

Thanks