[ZhangHanDong]

Add a Studio-based E2E driver with explicit build attachment, correlated widget snapshots and captures, strict semantic locators, isolated test profiles, and bounded failure evidence. Align the Robrix lockfile with the Makepad fork dev revision 139d751442608653df2afcef0d0f4f060a10343e and adapt the Splash startup API.

Integration status: the complete change is included in #336, which targets main directly. This Draft remains available to review the narrower diff; it does not need to merge before #336. Validation below applies to this branch's revision. Final integration validation and current limitations are recorded in #336.

Input steps require an expected visible state and a bounded timeout. The driver validates the whole plan before connecting, sends each input once, and saves the exact snapshot satisfying the postcondition. Every run requires a fresh evidence directory. These rules prevent ignored input and stale artifacts from being reported as success. A predicate already true before input proves only the observed state, not input acknowledgment.

Validation:

• 33 isolated harness tests passed, including ignored input, delayed state, query/build correlation, output reuse, capture validation, and owned-child cleanup.
• Release workspace tests: 737 passed, 5 existing ignored. Release app build, all-features Clippy, static UX gate, typos, patch guard, and full spec guard passed.
• Active contract: 23/24 passed, 0 failed, 1 manual GUI scenario skipped, 0 uncertain. The skipped real three-layer flow remains unaccepted; the shell gate allows manual task skips. Encryption capability: 7/7 passed, no skips.
• Independent re-review passed after repairing missing postconditions, whole-plan preflight, and reused-output handling. Remote build/test jobs are skipped by the repository workflow because this PR is Draft. The successful aggregate job is not build/test evidence.

Draft limitations: retained inactive Dock content can still produce ambiguous locators; those fail closed. Dynamic member rows may still need Computer Use. Input is restricted to window 0 until the hub honors the requested window. Recovery requires inspecting app state and preparing remaining steps; a complete input plan is never replayed automatically. This does not claim the full product E2E is accepted.