Complete Recovery 21 physical qualification

[Chris-ObtuseAI]

What changed

• Harden the physical Remote Assist qualifier for heterogeneous owner and worker offers.
• Retain view-only as the safe default and add an explicit one-event control exercise.
• Verify both frame and input authority are revoked after session close.
• Mark Recovery 21 native window dragging and physical Remote Assist complete in the README, release notes, and evidence ledger.

Why

The live two-machine run exposed a StrictMode crash when the qualifier inspected the owner's valid
local offer, which intentionally has no remote mesh endpoint. The installed product was healthy. The
qualifier now filters by the requested shipped capability without assuming every offer is remote.

Physical proof

• Two enrolled Windows machines with fresh signed offers.
• Signed 30-second view and control leases at fencing epoch 3.
• Native 1920x600 JPEG frames with independently verified SHA-256 digests.
• Exactly one centered mouse-move event acknowledged in control mode.
• Explicit session close.
• Post-close frame and input requests both denied with HTTP 404.
• No elevation or secure-desktop authority.

Validation

• PowerShell AST parse: PASS.
• Default view-only physical qualifier: PASS.
• Explicit control/input physical qualifier: PASS.
• Unsafe -ExerciseControlInput without -Mode control: rejected before API access.
• git diff --check: PASS.