feat(runtime): compose Flow 1.34 production stack

[abrichr]

What changed

This draft assembles the reviewed Flow 1.34 runtime prerequisites in their required order. Each source change stays in a separate commit so reviewers can trace its origin and compare it with the held branch.

The stack contains:

• the macOS Chrome accessibility-title fix from fix(macos): match known Chrome AX title suffixes #398, without its stale documentation changes
• the strict hosted runner adapter from Add strict hosted runner execution adapter #405
• the recovered atomic frame observation and actuation lease
• native resize and multi-monitor geometry support
• the exact held docs: align Flow claims and limits with current contracts #409 onboarding and rejected-write commits
• signed terminal proofs for verified, halted, and reconciliation outcomes

The combined test found a real defect. A valid browser navigation changed the page identity, and the read-only region verifier classified that change as a resize. The fix keeps the strict geometry epoch for actuation and gives read-only region checks a coordinate-mapping epoch. A navigation can replace the document. A changed viewport, display topology, window, or session still refuses the check.

This draft doesn't replace #398, #405, or the held #409 branch. It records the tested release order. It must stay unmerged until the source reviews finish and the exact stack head passes the protected release gate.

Validation

• focused combined stack: 722 passed, 17 skipped
• post-fix runtime regression set: 264 passed
• Ruff check and format: passed
• whole-package mypy: 253 source files passed
• strict safety mypy: 27 source files passed
• git diff --check: passed

Tests used the matching local Capture native-geometry dependency at 4bf541c. The Flow release still needs the admitted Capture release before final qualification.

Release condition

Do not merge or publish from this draft. The next stack layer must build the wheel and sdist once, retain the exact candidate outside Actions retention, verify central qualification, create the protected annotated tag, publish those same bytes once, and recover an existing tag without rebuilding.