fix(control): protect Wayland host cursor

[mrprecioustech]

Summary:

• Disable KWin cursor restoration by default on Wayland.
• Keep remote movement virtual so it cannot continuously warp the host pointer.
• Suppress compositor updates during an experimental borrowed-click restore, preventing PairUX synthetic movement from becoming the next restore origin.
• Retain Ctrl+Shift+Escape as the host emergency stop.

Verification:

• Remote-input typecheck and 188 tests passed.
• Desktop typecheck and 587 tests passed.
• Workspace lint and typecheck passed.
• Remote-input and desktop builds passed.

Note: the monorepo build still fails in the unrelated mobile Expo prebuild step: Cannot read properties of undefined (reading extract).

[github-actions]

ThreatCrush Security Scan

170 finding(s)

HIGH/CRITICAL: 16 | MEDIUM: 48 | LOW: 106

Severity	Rule	Location
HIGH	sh-eval-expansion	.githooks/pre-commit:33
HIGH	sh-remote-script-execution	apps/installer/scripts/install.sh:691
HIGH	sh-unquoted-expansion-destructive	apps/installer/scripts/install.sh:715
HIGH	sh-remote-script-execution	apps/installer/scripts/install.sh:813
HIGH	sh-remote-script-execution	apps/installer/scripts/install.sh:815
HIGH	sh-remote-script-execution	apps/installer/scripts/install.sh:894
HIGH	sh-unquoted-expansion-destructive	apps/installer/scripts/install.sh:910
HIGH	sh-remote-script-execution	apps/installer/scripts/install.sh:1064
HIGH	sh-remote-script-execution	apps/installer/scripts/install.sh:1066
HIGH	sh-remote-script-execution	apps/installer/scripts/install.sh:1128
HIGH	secret-generic-credential	apps/livekit/fly.toml:12
HIGH	sh-remote-script-execution	apps/livekit/setup-livekit-server.sh:93
HIGH	sh-remote-script-execution	apps/turn/deploy-droplet.sh:62
HIGH	secret-generic-credential	apps/turn/fly.toml:11
HIGH	secret-generic-credential	docs/API.md:747
HIGH	secret-generic-credential	docs/API.md:753
MEDIUM	insecure-temp-file	.githooks/commit-msg:19
MEDIUM	insecure-temp-file	.githooks/post-commit:22
MEDIUM	insecure-temp-file	apps/desktop/src/main/streaming/index.test.ts:64
MEDIUM	insecure-temp-file	apps/installer/scripts/install.sh:370
MEDIUM	insecure-temp-file	apps/installer/scripts/install.sh:393
MEDIUM	insecure-temp-file	apps/installer/scripts/install.sh:402
MEDIUM	insecure-temp-file	apps/installer/scripts/install.sh:438
MEDIUM	js-unescaped-html-sink	apps/web/src/app/blog/[slug]/page.tsx:48
MEDIUM	js-unescaped-html-sink	apps/web/src/app/blog/[slug]/page.tsx:73
MEDIUM	js-unescaped-html-sink	apps/web/src/app/c/[handle]/page.tsx:191
MEDIUM	js-unescaped-html-sink	apps/web/src/app/l/[joinCode]/page.tsx:165
MEDIUM	js-unescaped-html-sink	apps/web/src/app/layout.tsx:128
MEDIUM	js-unescaped-html-sink	apps/web/src/app/live/page.tsx:145
MEDIUM	js-unescaped-html-sink	apps/web/src/app/page.tsx:122
MEDIUM	js-unescaped-html-sink	apps/web/src/app/pricing/page.tsx:284
MEDIUM	js-open-redirect	apps/web/src/app/pricing/UpgradeButton.tsx:50
MEDIUM	js-unescaped-html-sink	apps/web/src/app/u/[username]/page.tsx:282
MEDIUM	manifest-install-lifecycle-script	package.json:54
MEDIUM	sql-template-interpolation	packages/ai-core/src/prompts.ts:36
MEDIUM	insecure-temp-file	packages/remote-input/src/backends/waylandYdotool.test.ts:101
MEDIUM	insecure-temp-file	packages/remote-input/src/backends/waylandYdotool.test.ts:116
MEDIUM	insecure-temp-file	packages/remote-input/src/backends/waylandYdotool.test.ts:132
MEDIUM	insecure-temp-file	packages/remote-input/src/backends/waylandYdotool.test.ts:153
MEDIUM	insecure-temp-file	packages/remote-input/src/backends/waylandYdotool.test.ts:180
MEDIUM	insecure-temp-file	packages/remote-input/src/backends/waylandYdotool.test.ts:209
MEDIUM	insecure-temp-file	packages/remote-input/src/backends/waylandYdotool.test.ts:234
MEDIUM	insecure-temp-file	packages/remote-input/src/backends/waylandYdotool.test.ts:257
MEDIUM	insecure-temp-file	packages/remote-input/src/backends/waylandYdotool.test.ts:293
MEDIUM	insecure-temp-file	packages/remote-input/src/backends/waylandYdotool.test.ts:318
MEDIUM	insecure-temp-file	packages/remote-input/src/backends/waylandYdotool.test.ts:344
MEDIUM	insecure-temp-file	packages/remote-input/src/backends/waylandYdotool.test.ts:366
MEDIUM	insecure-temp-file	packages/remote-input/src/backends/waylandYdotool.test.ts:403
MEDIUM	js-shell-exec-interpolation	scripts/lib/package-managers/apt.ts:154
MEDIUM	js-shell-exec-interpolation	scripts/lib/package-managers/apt.ts:160

…and 120 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.