feat(01-14): monitorTypeSurfaces:'include' — narrow picker to monitor surfaces only

[per Plan 01-14; closes B-01-14-01 via Step 1b lockstep]

- src/offscreen/recorder.ts: add monitorTypeSurfaces:'include' as top-level
  DisplayMediaStreamOptions sibling of video: (W3C Screen Capture spec §6.1;
  Chrome >= 119; removes tab/window panes from the operator's picker per
  Plan 01-10 RESEARCH §5 + §Pitfall-5 recommendation). Typed widening cast
  extended in lockstep to keep the explicit-typing contract (no `as any`).
  D-15 post-grant validation block at recorder.ts:294 UNCHANGED — belt
  (picker narrowing) + suspenders (post-grant tear-down) chain preserved.

- tests/offscreen/display-surface-constraint.test.ts: lockstep update of
  the strict-deep-equality assertion at lines 223-226 with the same key
  ordering as the source change (video -> monitorTypeSurfaces -> audio).
  toHaveBeenCalledWith contract preserved (NO expect.objectContaining —
  the test author's "catches future drops of ANY field" discipline is
  honored). This edit + the source change land in the SAME commit so the
  98/98 baseline never crosses a commit boundary in RED state.

- src/test-hooks/offscreen-hooks.ts: capture last constraints object in
  module-scoped `lastGetDisplayMediaConstraints` cell (was `_constraints`
  received-but-unused; renamed to `constraints`); add `get-last-getDisplayMedia-constraints`
  bridge op to the __mokoshOffscreenQuery dispatcher between
  get-display-surface and get-segment-count. Defensive try/catch mirrors
  the existing dispatcher pattern; the cell is module-internal so the
  MokoshTestSurface cross-cast in types.ts requires NO change (decision
  documented inline in offscreen-hooks.ts).

- tests/uat/extension-page-harness.ts: add `assertA23` mirroring `assertA3`
  (bridge query → 2-check AssertionResult: non-null constraints + value).
  Extend the `Window.__mokoshHarness` declaration + runtime export + status
  bar text + console.log to reference A23.

- tests/uat/lib/harness-page-driver.ts: export `driveA23(page)` mirroring
  the `driveA14` page.evaluate wrapper shape. Standard read-only driver.

- tests/uat/harness.test.ts: extend FORBIDDEN_HOOK_STRINGS (line 85) with
  `lastGetDisplayMediaConstraints` and `get-last-getDisplayMedia-constraints`.
  Import driveA23. Append `{ name: 'A23', drive: driveA23 }` to the drivers
  array after the A14 entry. Update header comment + orchestrator stdout
  to reflect A14 + A23 chain. The `Total = drivers.length + 1` arithmetic
  adapts automatically: 14 + 1 = 15 → 15 + 1 = 16.

- tests/background/no-test-hooks-in-prod-bundle.test.ts: lockstep
  extension of FORBIDDEN_HOOK_STRINGS (line 105) with the same 2 strings.
  Header comment updated to "Total: 12 surface strings." (was 10).
  Confirms production `dist/` has ZERO occurrences after `npm run build`
  via the `__MOKOSH_UAT__` dead-branch tree-shake (T-01-14-04 mitigation).

D-01 (whole-desktop only via getDisplayMedia; reject window/tab surfaces) is
the design intent that monitorTypeSurfaces:'include' realizes at the picker-
UI level. D-15 post-grant validation (recorder.ts:294-307) remains the
actual enforcement against managed-policy/DevTools/older-Chrome overrides.

Verification chain (per Plan 01-14 §verify; clean post-commit):
- `npx tsc --noEmit` exit 0
- `npm run build` exit 0; dist/ produced, monitorTypeSurfaces ships in
  the offscreen chunk as the operator-facing picker hint
- `npm run build:test` exit 0; dist-test/ produced with the harness
  hooks intact (gated)
- `npm test` 100/100 GREEN (was 98/98; +2 via the 2 new FORBIDDEN_HOOK_STRINGS
  parametrized tests — both PASS, production bundle hook-free)
- `npm run test:uat` 16/16 GREEN (15 → 16 via A23). A23 reads constraints
  `{video: {...}, monitorTypeSurfaces: 'include', audio: false}` from the
  fakeGetDisplayMedia capture cell — round-trips through the full call site.
- Production bundle spot-check:
    `grep -rc 'lastGetDisplayMediaConstraints\|get-last-getDisplayMedia-constraints' dist/ | grep -v ':0$'`
    → empty (all `:0` filtered) → ZERO leakage.

References:
- W3C Screen Capture §6.1 DisplayMediaStreamOptions:
  https://www.w3.org/TR/screen-capture/#dom-displaymediastreamoptions-monitortypesurfaces
- Chrome screen-sharing-controls (Chrome 119+):
  https://developer.chrome.com/docs/web-platform/screen-sharing-controls
- Plan 01-10 RESEARCH §5 + §Pitfall-5 (recommendation provenance):
  .planning/phases/01-stabilize-video-pipeline/01-10-RESEARCH.md
- Architectural-note (replaces retired AMENDMENT-A.md improvisation per
  01-11-SUMMARY): canonical GSD ceremony — plan → checker (B-01-14-01)
  → executor → SUMMARY (this commit).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/uat/extension-page-harness.ts

@@ -1903,6 +1903,81 @@ async function assertA14(): Promise<AssertionResult> {
   return result;
 }
 
+/**
+ * A23 — Plan 01-14 picker-narrowing constraint verification.
+ *
+ * Asserts that the production `getDisplayMedia` call at
+ * src/offscreen/recorder.ts:270 passes `monitorTypeSurfaces: 'include'`
+ * as a top-level constraint sibling of `video:` (W3C Screen Capture
+ * spec §6.1; Chrome ≥ 119 picker-narrowing semantics — only monitor
+ * surfaces are offered, no Window/Chrome-Tab panes).
+ *
+ * Queries the offscreen bridge `get-last-getDisplayMedia-constraints` op
+ * which reads the recorded constraints from the `fakeGetDisplayMedia`
+ * shim's last invocation. A23 chains AFTER A14 (A14 is the final read-
+ * only post-SAVE state check; A23 is independent because A2's
+ * setupFreshRecording already invoked getDisplayMedia and the recorded
+ * cell is read-only from A23's perspective — no side effects).
+ *
+ * Mirrors `assertA3` (line 686): bridge query → structured AssertionResult
+ * with two checks (non-null constraints + monitorTypeSurfaces value).
+ *
+ * @returns Structured result with the monitorTypeSurfaces check.
+ */
+async function assertA23(): Promise<AssertionResult> {
+  const result: AssertionResult = {
+    passed: false,
+    name: 'A23 — getDisplayMedia called with monitorTypeSurfaces:\'include\' (Plan 01-14 picker narrowing)',
+    checks: [],
+    diagnostics: [],
+  };
+
+  try {
+    diag(result, "Step 1: bridge query 'get-last-getDisplayMedia-constraints'");
+    const resp = await offscreenQuery<{
+      constraints?: DisplayMediaStreamOptions | null;
+      ok?: boolean;
+      error?: string;
+    }>('get-last-getDisplayMedia-constraints');
+    diag(result, `Step 1 result: ${JSON.stringify(resp)}`);
+
+    if (resp.ok === false) {
+      throw new Error(
+        `get-last-getDisplayMedia-constraints returned ok=false: ${resp.error ?? '(no error)'}`,
+      );
+    }
+    const constraints = resp.constraints ?? null;
+
+    result.checks.push({
+      name: 'A23.1: constraints object recorded by fakeGetDisplayMedia (non-null)',
+      expected: 'non-null DisplayMediaStreamOptions',
+      actual: constraints === null ? '<null>' : JSON.stringify(constraints),
+      passed: constraints !== null,
+    });
+    // The constraints object MAY be widened by the production cast (per
+    // Plan 01-14 source change) to include the top-level field, so we
+    // dot-access via the same indexed-property shape (`as any`) since
+    // monitorTypeSurfaces is not in the lib.dom.d.ts DisplayMediaStreamOptions
+    // ambient (TypeScript bundled types lag the W3C spec — same lag that
+    // forced the `cursor: 'always'` typed-widening cast on recorder.ts:268).
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- constraints widening for top-level monitorTypeSurfaces sibling per W3C spec §6.1 (lib.dom.d.ts lag)
+    const monitorTypeSurfaces = (constraints as any)?.monitorTypeSurfaces ?? null;
+    result.checks.push({
+      name: 'A23.2: constraints.monitorTypeSurfaces === \'include\' (W3C spec §6.1; Chrome ≥ 119 picker narrowing)',
+      expected: 'include',
+      actual: monitorTypeSurfaces,
+      passed: monitorTypeSurfaces === 'include',
+    });
+
+    result.passed = result.checks.every((c) => c.passed);
+  } catch (err) {
+    result.error = err instanceof Error ? err.message : String(err);
+    diag(result, `THREW: ${result.error}`);
+  }
+
+  return result;
+}
+
 /**
  * Read `chrome.runtime.getManifest().version`. Used by the host-side
  * orchestrator at startup to capture the expected version for A13's
@@ -1934,6 +2009,7 @@ declare global {
       assertA12: () => Promise<AssertionResult>;
       assertA13: () => Promise<AssertionResult>;
       assertA14: () => Promise<AssertionResult>;
+      assertA23: () => Promise<AssertionResult>;
       getManifestVersion: () => Promise<string>;
     };
   }
@@ -1954,14 +2030,15 @@ window.__mokoshHarness = {
   assertA12,
   assertA13,
   assertA14,
+  assertA23,
   getManifestVersion,
 };
 
 const statusEl = document.getElementById('status');
 if (statusEl !== null) {
-  statusEl.textContent = 'Harness ready. window.__mokoshHarness.{assertA1..assertA14, getManifestVersion} available.';
+  statusEl.textContent = 'Harness ready. window.__mokoshHarness.{assertA1..assertA14, assertA23, getManifestVersion} available.';
 }
 
-console.log('[harness-page] ready — window.__mokoshHarness installed (Plan 01-13 Task 9: A1..A14 + getManifestVersion)');
+console.log('[harness-page] ready — window.__mokoshHarness installed (Plan 01-13 Task 9: A1..A14 + Plan 01-14: A23 + getManifestVersion)');
 
 export {};