fix(cu): require observed Electron page identity

[hqhq1025]

Summary

• fail closed when a bound Electron pointer or drag action has no page identity from its observation
• keep unbound direct backend calls compatible with existing behavior
• prevent both semantic page dispatch and pixel fallback in the missing-identity case

Verification

• npm --workspace @maka/computer-use test (128/128 passing)
• git diff --check

[Astro-Han]

Two mutation paths still bypass the new fail-closed page-identity boundary:

• P1: middle_click and triple_click do not enter the new Electron page-identity validation and can still reach compatibility pixel dispatch without an observed page identity.
• P1: When process classification returns unknown, the semantic path returns handled: false before the new check, allowing click/drag to fall back to pixel input.
• P2: scroll has the same missing identity check, although its impact is lower than pointer clicks.

Please apply the page-identity requirement to every public pointer mutation before any compatibility fallback is selected.

[hqhq1025]

Superseded by #984, which consolidates #930-#933 into one target-identity boundary and addresses the requested changes. Stable AX token delivery is tracked in trycua/cua#2210.