[iamnbutler]

Adds Pause All Input to the Desktop Tools menu. While it's on, agents can still observe but can't change anything.

• What's refused. Every request whose result contract mutates the desktop, plus clipboard writes, is refused before dispatch with outcome refused and this message: "Input is paused in Desktop Tools, so nothing was sent. Ask the user to resume input from the Desktop Tools menu; reading the desktop still works." Reads keep working: listings, the AX tree, captures and clipboard reads. Snapshot bookkeeping and releasing or revoking a held pointer are exempt, so nothing stays held.
• User-only. No client op or tool can toggle it. The only way to change it is the app menu, through the new C ABI desktop_tools_set_paused(bool) used by the embedding app. Status JSON gains paused.
• In memory. The state isn't saved, so the app starts resumed.
• Visible. While paused, the menu-bar icon becomes pause.circle.fill and the status line reads "(input paused)".
• Activity. A refusal caused by the pause is listed with outcome "paused" and a pause icon.
• Patch. This extends peekaboo-operation-record.patch in place (rebased, not stacked) with an operationAdmission hook: Server, Bootstrap, Embedded runtime config, and the check in routeUnrecorded after operation access validation and before target reporting and dispatch. It adds no new op, so the wire count is unchanged. A new Swift test covers refusal before dispatch and its recording as refused.

Known gap: desktop_input_source select calls TIS in the client process rather than going through the Bridge, so pause doesn't stop it, and it isn't in the activity list. This is documented in docs/app.md. The fix would be to move the select into a host op as a follow-up.

Checks

• npm run -s check, npm test (52 pass)
• Peekaboo PeekabooBridgeOperationRecordTests (6 tests in 2 suites)
• Native build and signed dev app. With pause off, desktop_apps works through the admission hook.
• Live: toggle pause in the menu, see the icon change, a click is refused with the message and listed as "paused" in activity, a capture still works, resume and the click works again. pending: screen locked (tracked in Run the live checks deferred while the screen was locked #42)