feat(01-14): monitorTypeSurfaces:'include' — narrow picker to monitor surfaces only

[per Plan 01-14; closes B-01-14-01 via Step 1b lockstep]

- src/offscreen/recorder.ts: add monitorTypeSurfaces:'include' as top-level
  DisplayMediaStreamOptions sibling of video: (W3C Screen Capture spec §6.1;
  Chrome >= 119; removes tab/window panes from the operator's picker per
  Plan 01-10 RESEARCH §5 + §Pitfall-5 recommendation). Typed widening cast
  extended in lockstep to keep the explicit-typing contract (no `as any`).
  D-15 post-grant validation block at recorder.ts:294 UNCHANGED — belt
  (picker narrowing) + suspenders (post-grant tear-down) chain preserved.

- tests/offscreen/display-surface-constraint.test.ts: lockstep update of
  the strict-deep-equality assertion at lines 223-226 with the same key
  ordering as the source change (video -> monitorTypeSurfaces -> audio).
  toHaveBeenCalledWith contract preserved (NO expect.objectContaining —
  the test author's "catches future drops of ANY field" discipline is
  honored). This edit + the source change land in the SAME commit so the
  98/98 baseline never crosses a commit boundary in RED state.

- src/test-hooks/offscreen-hooks.ts: capture last constraints object in
  module-scoped `lastGetDisplayMediaConstraints` cell (was `_constraints`
  received-but-unused; renamed to `constraints`); add `get-last-getDisplayMedia-constraints`
  bridge op to the __mokoshOffscreenQuery dispatcher between
  get-display-surface and get-segment-count. Defensive try/catch mirrors
  the existing dispatcher pattern; the cell is module-internal so the
  MokoshTestSurface cross-cast in types.ts requires NO change (decision
  documented inline in offscreen-hooks.ts).

- tests/uat/extension-page-harness.ts: add `assertA23` mirroring `assertA3`
  (bridge query → 2-check AssertionResult: non-null constraints + value).
  Extend the `Window.__mokoshHarness` declaration + runtime export + status
  bar text + console.log to reference A23.

- tests/uat/lib/harness-page-driver.ts: export `driveA23(page)` mirroring
  the `driveA14` page.evaluate wrapper shape. Standard read-only driver.

- tests/uat/harness.test.ts: extend FORBIDDEN_HOOK_STRINGS (line 85) with
  `lastGetDisplayMediaConstraints` and `get-last-getDisplayMedia-constraints`.
  Import driveA23. Append `{ name: 'A23', drive: driveA23 }` to the drivers
  array after the A14 entry. Update header comment + orchestrator stdout
  to reflect A14 + A23 chain. The `Total = drivers.length + 1` arithmetic
  adapts automatically: 14 + 1 = 15 → 15 + 1 = 16.

- tests/background/no-test-hooks-in-prod-bundle.test.ts: lockstep
  extension of FORBIDDEN_HOOK_STRINGS (line 105) with the same 2 strings.
  Header comment updated to "Total: 12 surface strings." (was 10).
  Confirms production `dist/` has ZERO occurrences after `npm run build`
  via the `__MOKOSH_UAT__` dead-branch tree-shake (T-01-14-04 mitigation).

D-01 (whole-desktop only via getDisplayMedia; reject window/tab surfaces) is
the design intent that monitorTypeSurfaces:'include' realizes at the picker-
UI level. D-15 post-grant validation (recorder.ts:294-307) remains the
actual enforcement against managed-policy/DevTools/older-Chrome overrides.

Verification chain (per Plan 01-14 §verify; clean post-commit):
- `npx tsc --noEmit` exit 0
- `npm run build` exit 0; dist/ produced, monitorTypeSurfaces ships in
  the offscreen chunk as the operator-facing picker hint
- `npm run build:test` exit 0; dist-test/ produced with the harness
  hooks intact (gated)
- `npm test` 100/100 GREEN (was 98/98; +2 via the 2 new FORBIDDEN_HOOK_STRINGS
  parametrized tests — both PASS, production bundle hook-free)
- `npm run test:uat` 16/16 GREEN (15 → 16 via A23). A23 reads constraints
  `{video: {...}, monitorTypeSurfaces: 'include', audio: false}` from the
  fakeGetDisplayMedia capture cell — round-trips through the full call site.
- Production bundle spot-check:
    `grep -rc 'lastGetDisplayMediaConstraints\|get-last-getDisplayMedia-constraints' dist/ | grep -v ':0$'`
    → empty (all `:0` filtered) → ZERO leakage.

References:
- W3C Screen Capture §6.1 DisplayMediaStreamOptions:
  https://www.w3.org/TR/screen-capture/#dom-displaymediastreamoptions-monitortypesurfaces
- Chrome screen-sharing-controls (Chrome 119+):
  https://developer.chrome.com/docs/web-platform/screen-sharing-controls
- Plan 01-10 RESEARCH §5 + §Pitfall-5 (recommendation provenance):
  .planning/phases/01-stabilize-video-pipeline/01-10-RESEARCH.md
- Architectural-note (replaces retired AMENDMENT-A.md improvisation per
  01-11-SUMMARY): canonical GSD ceremony — plan → checker (B-01-14-01)
  → executor → SUMMARY (this commit).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/uat/harness.test.ts

@@ -19,7 +19,17 @@
 // Plan 01-13 Task 9 closure (debug 01-09-save-stops-recording) adds A14:
 // post-SAVE auto-stop state check (badge='', popup='', no new
 // mokosh-recovery-*). Chains off A13's SAVE_ARCHIVE — read-only
-// observation, no new dispatch. Final target: 15/15 GREEN.
+// observation, no new dispatch.
+//
+// Plan 01-14 adds A23 as the final functional assertion (post-A14 chain):
+// read-only inspection of the last `getDisplayMedia` constraints from
+// A2's setupFreshRecording; verifies the production call site passes
+// `monitorTypeSurfaces: 'include'` (W3C Screen Capture spec §6.1; Chrome
+// ≥ 119 picker-narrowing semantics — removes the Window + Chrome-Tab
+// panes from the operator's picker dialog). A23 has no side effects
+// (the constraints cell is populated by A2 and read by the bridge op);
+// hence independent of A14's no-side-effects post-SAVE contract.
+// Final target: 16/16 GREEN.
 //
 // The orchestrator structure is final from Wave 3A onward; future waves
 // only fill in the assertion-driver stubs.
@@ -67,6 +77,7 @@ import {
   driveA12,
   driveA13,
   driveA14,
+  driveA23,
   getManifestVersion,
 } from './lib/harness-page-driver';
 import {
@@ -93,6 +104,10 @@ const FORBIDDEN_HOOK_STRINGS: ReadonlyArray<string> = [
   '__mokoshOffscreenQuery',
   'get-display-surface',
   'get-segment-count',
+  // Plan 01-14 A23 surface — lockstep with unit-gate inventory at
+  // tests/background/no-test-hooks-in-prod-bundle.test.ts:105.
+  'lastGetDisplayMediaConstraints',
+  'get-last-getDisplayMedia-constraints',
 ];
 
 /** Build timeout for the pre-flight production rebuild (matches unit-gate value). */
@@ -230,8 +245,8 @@ async function assertA0_GrepGate(): Promise<{
  * @returns Process exit code: 0 on 15/15 GREEN, 1 on any failure.
  */
 async function main(): Promise<number> {
-  process.stdout.write('\nMokosh Plan 01-13 — UAT harness orchestrator\n');
-  process.stdout.write('Architecture: A0 pre-flight + extension-internal page driver (A1..A13)\n');
+  process.stdout.write('\nMokosh Plan 01-13 + 01-14 — UAT harness orchestrator\n');
+  process.stdout.write('Architecture: A0 pre-flight + extension-internal page driver (A1..A14, A23)\n');
   process.stdout.write('='.repeat(72) + '\n');
 
   // A0 pre-flight (no Chrome launch needed; runs against built dist/).
@@ -309,6 +324,13 @@ async function main(): Promise<number> {
     // notification ids state; no new SAVE dispatch — A13's already
     // exercised the SAVE path. Recording stays stopped after A14.
     { name: 'A14', drive: driveA14 },
+    // Plan 01-14 A23: read-only inspection of the last getDisplayMedia
+    // constraints object captured by A2's setupFreshRecording. Verifies
+    // the production call at src/offscreen/recorder.ts:270 passes
+    // `monitorTypeSurfaces: 'include'` (W3C Screen Capture spec §6.1;
+    // Chrome ≥ 119 picker-narrowing semantics). Independent of A14 —
+    // no new getDisplayMedia call, no new state change.
+    { name: 'A23', drive: driveA23 },
   ];
 
   const buffers = { swConsole: handles.swConsole, offConsole: handles.offConsole };
@@ -351,7 +373,9 @@ async function main(): Promise<number> {
   }
 
   const passedCount = results.filter((r) => r.passed).length;
-  // Total = 1 (A0) + drivers.length (A1..A14) = 15.
+  // Total = 1 (A0) + drivers.length (A1..A14, A23) = 16. Plan 01-14
+  // appended A23 after A14 — the running count adapts via `drivers.length`
+  // so no manual update is needed when future plans extend the chain.
   const total = drivers.length + 1;
   const finalPassed = passedCount + 1; // +1 for A0 (we already passed it to reach here)