[iamnbutler]

Item 2 from #75. desktop_screen and desktop_inspect take save_path, overwrite and region.

• save_path: an absolute, normalized path ending in .png, in a folder that already exists. The file is the host's full-resolution capture, never scaled. The result's saved gives {path, width, height, region} in pixels.
• Refusals before capture:
  • An existing file, unless overwrite: true.
  • A symlink or folder, which is never replaced, even with overwrite.
  • overwrite or region without save_path.
• No overwrite race: the copy uses COPYFILE_EXCL unless overwrite is set, so a file created between validation and write is not replaced.
• region: given in global top-left desktop points, as window and display bounds use. It's mapped through the capture's own pixel scale:
  • desktop_screen maps against display.bounds.
  • desktop_inspect maps against coordinate_context.logicalBounds.
  • It must lie inside that area, with half a point of slack.
  • The returned model image stays whole, so inspect's pointer fractions still match it.
• TS only: no native or bridge changes. The cropping uses sips, the same tool already used to make the JPEG for the model.

New src/capture-file.ts, with test/capture-file.test.mjs running real sips:

• validation refusals
• full-resolution copy
• a 2× region crop checked by pixel colour
• a late-appearing file kept
• a non-PNG capture converted

Live check: this branch's dist was run against the installed 0.7.0 host. The existing-file and region-without-save_path refusals return before capture. The capture itself is pending: screen locked (the host refuses capture while the session is locked).