fix(windows/capture): stand the IddCx hardware cursor down while the secure desktop is up

0.18.0 regression: UAC consent and Winlogon (lock/logon) stopped appearing
in streams. The cursor channel's IddCx hardware-cursor declare — re-issued
by the driver on every swap-chain assign — keeps the path out of the OS's
software-cursor mode, which is the only mode the secure desktop renders
through; DWM then never presents UAC/Winlogon into our swap-chain and the
stream repeats the last normal-desktop frame for the whole interaction.

The GDI cursor poller now classifies the input desktop on its reattach
cadence (UOI_NAME != Default = secure, 250 ms cadence instead of 2 s), and
the capturer edge-triggers the existing-but-unused proto-v6
IOCTL_SET_CURSOR_FORWARD flip: OFF at secure entry (the driver stops its
per-assign re-declare; the host facade forces the same-mode re-commit that
actualises the software-cursor default, under the vdisplay manager lock via
the new force_recommit()), back ON at dismissal for channel sessions.
Channel-session open resets the driver's persisted desired state to ON so
a session that died mid-secure-desktop can't leave the next one adopting
UNdeclared (the §8.6 cross-session composite trap); orderly teardown does
the same. The flip closure is built for every Windows session — a
channel-less session can reuse a driver monitor whose earlier-session
cursor worker still re-declares, and NOT_FOUND from never-declared targets
is ignored.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

crates/pf-vdisplay/src/vdisplay/windows/manager.rs

@@ -300,6 +300,21 @@ pub fn control_device_handle() -> Option<HANDLE> {
     VDM.get().and_then(VirtualDisplayManager::device_handle)
 }
 
+/// Re-commit the CURRENT display config under the manager `state` lock (the sole-topology-mutator
+/// contract of [`force_mode_reenumeration`]). The secure-desktop guard's actuator: the OS only
+/// reverts a path to its software-cursor default ON a mode commit, so standing the hardware-cursor
+/// declare down (`IOCTL_SET_CURSOR_FORWARD` off) needs this nudge for UAC/Winlogon to actually
+/// render. `false` (no-op) before the first backend open — no monitors exist to re-commit for.
+pub fn force_recommit() -> bool {
+    let Some(m) = VDM.get() else {
+        return false;
+    };
+    let _guard = m.state.lock().unwrap();
+    // SAFETY: `force_mode_reenumeration`'s contract is "call under the manager `state` lock";
+    // held above. The call reads + re-applies the current CCD config over owned locals.
+    unsafe { pf_win_display::win_display::force_mode_reenumeration() }
+}
+
 /// Best-effort "is this WUDFHost pid still alive?" — the monitor-liveness probe for the JOIN path.
 /// `OpenProcess` failing (pid reaped) or the process being signaled ⇒ dead. Pid reuse could
 /// theoretically alias a fresh process and read "alive"; the joining session then just retries into