action-bar hover stops re-deriving, and multisampling asks the GPU

- hovering the action bars re-derived the whole layout graph and hovering bags did not: `GameTooltip:SetOwner(owner, "ANCHOR_NONE")` dropped the tooltip's anchors through the conservative whole-graph derive, and with `UberTooltips` at its shipped default every action-bar button routes through that arm while a bag slot anchors `ANCHOR_RIGHT` and never does — the arm now retargets to the empty target set, and derive frames fall from 15.9 % of hovered frames to 0.2 %
- `gxMultisample` clamps to what the GPU actually offers: Apple GPUs stop at 4x, so a typed 8 was a wgpu validation panic on frame one — the clamp intersects the supported counts of every format the client multisamples into and steps the request down the way the reference's device-init retry loop does, with a warning that says so
- the Multisampling dropdown lands on the Graphics page with the device's own stops, built from the same enumeration that clamps a typed value on the reference's three bindings (`GetMultisampleFormats`, `GetCurrentMultisampleFormat`, `SetMultisampleFormat`) — a fixed Off/2x/4x/8x ladder would put a crash on the menu of every GPU that stops at 4
- capture hardening: a run whose `$WOW_WIN` the display clamped is refused in ~2 s instead of producing a wrong-sized shot to diff, a capture never reads the OS pointer (a cursor resting over the window arms a hover and a tooltip that a cursor an inch to the left does not), and the stall sampler writes into `benilla-config` instead of a hand-built `~/Library/Logs` path

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

crates/benilla-app/src/ui_script/input.rs

@@ -36,6 +36,9 @@ pub(super) struct PointerFeed<'w> {
     /// cursor must not fight it. Same arm as `hidden` below, for the same reason: the mouse half
     /// of this pass is not ours this frame.
     synthetic: Res<'w, super::SyntheticPointer>,
+    /// A capture owns the pointer for its whole run ([`super::CapturePointerPinned`]) — the OS
+    /// cursor belongs to whoever is at the keyboard and must not reach the shot.
+    capture_pinned: Res<'w, super::CapturePointerPinned>,
 }
 
 impl PointerFeed<'_> {
@@ -94,7 +97,10 @@ pub(super) fn feed_ui_input(
     // WHOLE mouse half out — including the else-arm below, which is the half that matters: a
     // `pointer_left_window` between the synthetic press and the synthetic release would disarm
     // the gesture the probe is in the middle of.
-    let synthetic = pointer.synthetic.0;
+    // The two reasons the OS pointer is not ours this frame: a probe is driving a gesture through
+    // the real pointer path, or this is a capture (where it is never ours). Same treatment — skip
+    // the mouse half whole, touch nothing — so they read as one condition here.
+    let synthetic = pointer.synthetic.0 || pointer.capture_pinned.0;
     let (hover, click_consumed, payload_held) = (
         &mut pointer.hover,
         &mut pointer.click_consumed,