refactor(computer-use): extract TOCTOU target re-verification from cua-driver-backend.ts

Part of #1084 (second-pass sink-file and boundary governance). The file grew to 2734 lines; cua-driver-snapshot.ts (233 lines) is the ready-made mirror for the extraction pattern. Scope re-verified against current main.

Scope

Move the target staleness/occlusion re-verification cluster from cua-driver-backend.ts into cua-driver-target-resolution.ts, injected the same way as the snapshot module:

• validateSemanticElementVisibility (~L1073, incl. the target_occluded winner logic)
• validateStoredWindow (~L1155)
• boundWindowPoint (~L1268)
• validateBoundCoordinate (~L1294, stale_frame)
• coordinateTarget (~L1432)
• refetchSemanticElement (~L1442)
• the stale_frame/target_occluded error branches (~L1147/1421/1481–1508/1951–1963)

Invariants

Same as #1084: behavior-neutral; stable exports; no reverse imports; flat PR off main.

Verification

Typecheck/build + the existing __tests__/cua-driver-backend.test.ts coverage.