feat(visual-verification): Phase 0 engine-agnostic eye-test harness

[IanFrelinger]

Summary

Implements Phase 0 of the visual verification vertical: an engine-agnostic harness that runs a target under a virtual display, replays deterministic scripted scenarios, captures frames, and emits Ed25519-signed eye-test session records.

Changes

• Nexo.VisualVerification — core records, canonical scenario hashing, dHash perceptual tier (ε=5), frame content store, golden witness storage, Ed25519 signing (parallel sibling to CertifiedTransition)
• Nexo.VisualVerification.Providers — IDisplayProvider / ITargetAppProvider seams, SimulatedDisplayProvider (CI path), XvfbDisplayProvider (integration trait), EyeTestHarness with mandatory double-run determinism gate
• Nexo.ToyRenderer — deterministic toy target (xoshiro256** PRNG, spawn/despawn/pause channels, software RGBA renderer) + self-playing demo entry point
• Nexo.VisualVerification.Tests — seven rejection tests (R1–R7) plus engine-agnostic core scan and checked-in demo scenario
• samples/visual-verification/demo-scenario.json — seeded demo scenario for CI
• README — threat model, determinism prerequisites, explicit presentation-stability scope

Design decisions (open questions resolved)

Question	Decision
CertifiedTransition subtype?	Parallel EyeTestSessionRecord with same Ed25519 authority via NSec
Perceptual hash + epsilon	dHash (9×8), Hamming ε=5, pinned by R7_PerceptualEpsilonBoundary
Frame storage	Hash-referenced raw RGBA8888 at {storageRoot}/{sha256}.raw
Golden isolation	GoldenRecordStore / GoldenEyeTestRecord witness-only; harness uses FrameExpectationSet

Testing

dotnet test tests/Nexo.VisualVerification.Tests/Nexo.VisualVerification.Tests.csproj
dotnet run --project tools/Nexo.ToyRenderer/Nexo.ToyRenderer.csproj -- /tmp/nexo-eye-demo

• 10/10 tests pass on headless Linux with no Xvfb (simulated provider path)
• Xvfb integration test skips cleanly when Xvfb/xwd/convert unavailable
• Commit history: rejection tests committed before implementation (f91bb3e5 → 4677476f)

Rejection tests (R1–R7)

1. Tampered frame bytes → verification fails
2. Wrong scenario vs golden → Mismatch
3. Nondeterministic target → NonDeterministic, signing throws
4. Hollow capture (identical blank frames) → CaptureFailure
5. Golden isolation source scan (providers + toy renderer)
6. Signature binding on field mutation
7. Perceptual epsilon boundary pinned

Checklist

• dotnet test tests/Nexo.VisualVerification.Tests passes locally (headless, no Xvfb)
• Documentation updated (src/Nexo.VisualVerification/README.md)
• No unresolved TODO / NotImplementedException
• Conventional commits; rejection tests precede implementation in history