input: one-packet pointer moves, uinput-only injection, fire-and-forget

- Pointer motion is now a single event carrying both coordinates (MOVE_ABS /
  MOVE_REL with x,y) rather than one event per axis; the adapter actuates both
  axes in a single batch. The per-axis ABS/REL kinds are removed.
- Input injection is uinput-only: the driver selection and the optional
  guest-side passthrough drop out of the adapter config (the driver is the
  driver's concern). A QMP path is still carried for the unchanged service
  power/lifecycle path.
- A per-event fire-and-forget flag lets a control inject input without an
  actuation acknowledgement, for high-rate streams; without it the addressed
  ACT_ACK is emitted as before. Service commands always acknowledge.

The neutral input payload gains x/y/flags, still within the inline event body.
Capability, lease and source gates are unchanged.

src/test/test_inputobs.c

@@ -85,8 +85,17 @@ static void test_held_query(void) {
     vmsig_ctx_free(ctx);
 }
 
+/* The public input contract must fit in the event's inline zone. */
+static void test_contract_size(void) {
+    printf("test_contract_size\n");
+    CHECK(sizeof(vmsig_input) <= sizeof(((vmsig_event*)0)->inln),
+          "vmsig_input fits in vmsig_event.inln");
+    CHECK(sizeof(vmsig_input) == 32, "vmsig_input is 32 bytes");
+}
+
 int main(void) {
     printf("test_inputobs\n");
+    test_contract_size();
     test_held_query();
     printf("inputobs tests: %s\n", g_fail ? "FAIL" : "PASS");
     return g_fail ? 1 : 0;