spike(kernel): fix transform-incorrect click routing + live click-debug overlay

The bug: route_point mapped the cursor with transform-UNAWARE math —
`(screen - GetAbsoluteOffset) / box`. screen coords are in transformed screen
space; GetAbsoluteOffset is in untransformed layout space. They coincide only
for an axis-aligned window, so plain --run tested fine, but on a --demo corner
(perspective + rotateX/rotateY) they diverge and clicks landed in the wrong
spot inside the client. --verify criterion 3 stayed green because it exercised
a DIFFERENT, correct path (unproject_to_local) the live code never called.

The fix: project the screen point onto the element's own plane FIRST via
RmlUi's transform-aware Element::Project() (ray/plane intersect through the
element's accumulated transform), then do the box->surface-local math in the
matching space. Project() is a no-op when untransformed, so --run is unchanged.
This is the live-path analogue of the pure-core inverse criterion 3 verifies.

Debug tool (press D in --demo): a per-surface magenta crosshair drawn as a
child of the hovered window, so RmlUi renders it THROUGH that window's own 3D
transform — it sits exactly under the wlr cursor iff the mapping is correct, so
any gap is the live click error, visible live (no screenshots). A #dbg readout
prints screen -> elem-local -> surface-local (also to the diagnostic log). 'D'
is consumed so it never types into the focused client.

Confirmed accurate on the real CF-AX3 seat. --verify ALL PASS, kernel suite
green, spike builds clean.

0 files changed, 0 insertions, 0 deletions