fix(cu): stabilize coordinate identity fingerprints

[hqhq1025]

Summary

Follow-up to the dynamic full-tree fingerprint P2 on merged #910.

• coordinate fingerprints now cover stable role/frame/depth structure
• dynamic labels, values, clocks, and progress text no longer invalidate an unchanged coordinate target
• semantic actions remain protected by exact element identity refetch and visibility checks
• target label/value changes still fail closed before semantic dispatch

Verification

• Computer Use full suite: 129/129
• Computer Use typecheck
• Runtime build
• regression coverage for dynamic coordinate content and changed semantic target identity
• git diff --check

[Astro-Han]

P1: A coordinate action can click a different control after the control at that position changes meaning.

contentFingerprint() now excludes labels and values, and coordinate validation treats matching role/frame/depth structure as fresh. If a SPA replaces “Delete” with “Confirm purchase” at the same position and structural slot, the old coordinate action passes validation and clicks the new control.

Please keep the structure-only fingerprint for unrelated dynamic content, but also bind and revalidate the actionable element at the source coordinate. A change to that element’s role/label/value/frame identity should return target_changed without dispatching the click.

[hqhq1025]

Superseded by #984, which consolidates #930-#933 into one target-identity boundary and addresses the requested changes. Stable AX token delivery is tracked in trycua/cua#2210.