fix(input,examples): a linked figure's wheel anchor uses the group's live edge, and every demo verdict reaches its exit status

Review fix pass 1 on the task 7 work; four findings, all closed.

1. The Qt demo's region sat across the middle of the window, which is exactly
   where its own scripted input check pans: after the check's box zoom the press
   opened DragMode::MoveRegion, the x range never moved, and the check printed
   'input check pan FAIL' -- under an exit 0, because the verdict was printed and
   not returned. The region now rides the left sixth (as the GLFW demo's does),
   both checks pass, and the verdict is wired to the exit status. The same audit
   found two more printed-only verdicts -- the GTK demo's scripted-resize layout
   check and its screenshot write (and Qt's) -- now wired too. What stays
   printed-only is the screenshot line of the GLFW host and the ImGui widget,
   where the dump happens inside the adapter's frame loop.

2. A follow-ing link group was invisible to the input layer: a member's own axis
   must be XFollow::Off (link_x() refuses a Live member), so Controller's
   x_zoom_anchor() extrapolated a coordinate from the pointer instead of using
   the live edge and a wheel over a row's axis strip walked the window back by
   19% of its width (behind 0.000000 -> 0.285809 s). The group now publishes its
   own edge to every member (Axis::live_owner + Plot::set_x_live_owner, written
   by Figure::push_link, cleared when the group stops following or the row
   unlinks), and x_zoom_anchor() reads it. Public-header addition, called out.
   Measured after: behind 0.012992 s and the window's right edge bit-identical to
   the edge the group published at the gesture.

3. The multiplot summary printed x_link_count() -- a number of groups -- under
   'rows in it'. It now reports the members and the group count separately, and
   every row line carries its own group id.

4. Host::controller_at() promised to clamp a pixel in a row gap to the nearest
   row and only clamped below the last one, so a gap pixel went to row 0. It now
   selects by distance, and tests/test_glfw_host.cpp pins it with a 40 px gap --
   the first coverage of the host's figure routing, which needs no window.

New cases: tests/test_controller.cpp x2 (the anchor and the hint's lifecycle),
tests/test_glfw_host.cpp x3 (routing, the gap, the single-plot fallback): 229
cases, 0 failed, ASan clean. All five demos exit 0, the three self-checking
modes exit 0, and the amended assertions were confirmed failing against the
pre-fix behaviour.

examples/gtk_demo.cpp

@@ -278,6 +278,12 @@ struct Demo {
   /// and the teardown (scheduled as an idle source).
   bool exit_started = false;
   bool torn_down = false;
+  /// The exit path's verdicts, carried out of the run so `main` can return them: whether the
+  /// scripted resize produced a recomputed layout, and whether the screenshot the headless
+  /// mode exists for actually reached the disk. Both are properties a caller checks with the
+  /// exit status, so neither may live only in stdout.
+  bool layout_recomputed = false;
+  bool screenshot_written = true;  ///< false only when a dump was asked for and failed
 
   bool cursors_follow = true;
   Meter meter;
@@ -364,6 +370,7 @@ gboolean on_render_after(GtkGLArea*, GdkGLContext*, gpointer user_data) {
     const plot::Rect viewport = demo.area->device_viewport();
     const bool written = dump_area_ppm(demo.dump_path, static_cast<int>(viewport.w),
                                        static_cast<int>(viewport.h));
+    demo.screenshot_written = written;
     std::printf("[gtk_demo] screenshot  %s (%dx%d GL px): %s\n", demo.dump_path,
                 static_cast<int>(viewport.w), static_cast<int>(viewport.h),
                 written ? "written" : "FAILED");
@@ -446,6 +453,12 @@ gboolean on_exit_timer(gpointer user_data) {
                                                after.x_title_height)) <= 0.5f;
   const bool metric_strip = drift < std::fabs(after.axes.x - scaled_strip);
   const bool recomputed = after.axes.w != before.axes.w && tiles && metric_strip;
+  // The verdict is carried out of the run, not only printed: a headless caller reads the
+  // exit status, and a check whose only output is a line of stdout is a check that passes
+  // whatever it finds. A run that cannot resize at all (a window manager or an X server
+  // that clamps the window to the screen) fails here, which is the honest answer -- the
+  // layout this run is supposed to prove is the layout it never got.
+  demo.layout_recomputed = recomputed;
   std::printf("\n[gtk_demo] ---- exit frame ----\n");
   std::printf("[gtk_demo] resize      logical %dx%d -> %dx%d, device viewport %ux%u, scale %g\n",
               width_before, height_before, gtk_widget_get_width(demo.area->widget()),
@@ -663,5 +676,18 @@ int main(int argc, char** argv) {
                                                       " resources went with it)");
 
   g_object_unref(app);
-  return app_result;
+  if (app_result != 0) return app_result;
+  if (!demo.screenshot_written) {
+    std::fprintf(stderr, "plot_gtk_demo: the screenshot could not be written\n");
+    return 1;
+  }
+  if (demo.automated && !demo.layout_recomputed) {
+    std::fprintf(stderr,
+                 "plot_gtk_demo: the scripted resize did not produce a recomputed layout (see the"
+                 " 'exit frame' lines above; the window must be able to reach %dx%d on this"
+                 " screen)\n",
+                 kExitWidth, kExitHeight);
+    return 1;
+  }
+  return 0;
 }