feat(input): add touch-action contact panning

[wieslawsoltes]

Closes #799. Completes the WebScene consumer phase of SceneTech/AppScene#298 after AppScene producer PR #299.

Problem and resulting behavior

Unchanged Code OSS contains 52 touch-action declarations across 27 files, while the input ABI previously exposed every pointer as a primary mouse. WebScene now decodes AppScene's versioned mouse/touch/pen metadata, exposes stable pointer IDs and cancellation, and applies a frozen ancestor touch-action policy to retained contact panning without changing the legacy mouse path.

Implementation

• generated native/managed CSS identity and CSSOM for auto, none, manipulation, pan-x, pan-y, and the two-axis combination;
• binary-compatible decoding in unused high flag bits with legacy mouse fallback and malformed/future-version rejection;
• pointer type, ID, primary state, capture-by-ID, and pointercancel teardown;
• fixed 16-entry per-contact gesture state with axis-qualified retained scrolling and no layout invalidation;
• no Code OSS patch, browser shell, hot per-node field, scene node, timer, or idle-frame demand.

Authored gates

• pointer ABI decoder contract;
• WPT-derived CSSOM/non-inheritance contract;
• native frozen-policy, touch/pen identity, capture/cancel, and mouse-compatibility regression;
• 4,096-node/40,960-mutation and 1,000-gesture performance guardrail.

Per the active fast-implementation direction, these gates were authored but not executed locally. git diff --check passed; build, test, WPT, visual, package, lifecycle, memory, and performance evidence remains deferred and is recorded in docs/validation/code-oss-css-touch-action-799.md.