Add fail-closed macOS 27 selector driver

[malpern]

What changed

• add a macOS 27 selector-evidence driver that records the exact OS build, Peekaboo preflight, System Settings accessibility snapshot, and declared selector contract
• classify missing desktop permissions as an environment precondition and missing selectors as unsupported instead of guessing coordinates or blaming KeyPath
• add a lease-owned, bounded Parallels console-key command for non-secret navigation in disposable macOS 26/27 guests
• document the clean-base versus Desktop Automation Base boundary and the required independent UI postconditions

Why

Fresh macOS 27 clones currently expose an automation-infrastructure gap: the clean source does not contain the tools, approvals, Remote Management state, or Apple-Account-free console state required for selector capture. This change makes that boundary explicit and fail-closed while providing the evidence driver needed to validate the reusable Desktop Automation Base next.

Impact

Automation will stop before running a System Settings scenario when the guest is not selector-ready. Results distinguish lab preparation failures from unsupported OS selectors and product failures.

Validation

• python3 Scripts/lab/tests/macos-27-selector-driver-tests.py (5 tests)
• bash -n Scripts/lab/keypath-lab
• zsh -n Scripts/lab/remote.sh
• Scripts/lab/tests/keypath-lab-tests.sh
• git diff --check

The repository review gate selected the remote GitHub review check; this draft must not merge until that check passes.

[claude]

Scripts/lab/remote.sh — console_key(): resource-id regex is quoted, so it never matches (bug)

[[ "$resource" =~ '^[A-Fa-f0-9]{8}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{12}$' ]] || die "invalid Parallels resource id"

In bash, quoting any part of the RHS of =~ forces literal string matching, not regex matching (this is documented =~ behavior, a well-known gotcha). Since the entire pattern here is single-quoted, bash checks whether the literal string ^[A-Fa-f0-9]{8}-...{12}$ appears as a substring of $resource — it never will for an actual UUID, so this check will always fail and console-key will always die "invalid Parallels resource id", even for a perfectly valid provider_resource.

Compare with the correctly-written validation added a few lines earlier in the same PR (Scripts/lab/keypath-lab):

[[ ${2:-} =~ ^[0-9]+$ ]]   # unquoted — real regex match

The fix is simply to drop the quotes around the UUID pattern:

[[ "$resource" =~ ^[A-Fa-f0-9]{8}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{12}$ ]] || die "invalid Parallels resource id"

This also means the new test in Scripts/lab/tests/keypath-lab-tests.sh (run_remote console-key cbx_desktop27 73 37 expecting console_key\tpassed) should be failing today unless something else in the harness bypasses this code path — worth double-checking the test actually ran against this code before merge.

No other blocking issues found in the rest of the diff (the new macos-27-selector-driver fail-closed logic and docs look reasonable).