feat(input): native gamepad + touch + mouse-position hardware bindings (#51)

Wire the macOS platform side of the #50 device layer, feeding the same state
buffers the read APIs consume — no API changes, purely OS glue.

- mouse: cocoa.ll reads the live cursor via mouseLocationOutsideOfEventStream,
  converted to framebuffer pixels and y-flipped, so windowed games get
  Input.mouse_x/y without injection (W_mx/W_my were never written before).
- gamepad: win_pad polls GCController.controllers each frame, packing extended-
  gamepad buttons (SDL_GameControllerButton order) and thumbsticks (16.16 fixed,
  Y negated for SDL convention) into in_pad_*. Windowed builds now load
  GameController via -needed_framework (its classes are reached by name, so a
  plain -framework link dead-strips it); DCE'd in headless builds.
- touch: the view's NSTouch phase handlers snapshot the touching set into
  in_touch_* (normalizedPosition -> framebuffer pixels).

Web platform.js gains zero-fill stubs for win_held/mouse/pad/touch so a windowed
wasm build resolves the device-layer imports. New test asserts the windowed link
loads GameController. Reseeded; full + selfhost suites green (79 + 29).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

changes/input-hardware-bindings.md

@@ -0,0 +1,14 @@
+bump: minor
+type: feat
+**Native input hardware bindings (#51).** The #50 device layer's platform side
+is now wired on macOS, feeding the same state buffers the read APIs already use —
+no API changes. cocoa.ll reads the live cursor position (`mouseLocationOutsideOfEventStream`,
+converted to framebuffer pixels and y-flipped) so windowed games get
+`Input.mouse_x/y` without injection; polls GameController.framework each frame
+(`GCController.controllers` → extended-gamepad buttons/sticks) into
+`Input.pad_button` / `pad_axis` / `pad_connected`, mapping to SDL_GameControllerButton
+order; and routes the view's NSTouch phase handlers into `Input.touch_count` /
+`touch_x/y`. A windowed build now loads GameController (via `-needed_framework`,
+since its classes are reached by name); the whole binding is DCE'd out of a
+headless build. `Input.set_pad` / `set_touch` injection still works on every
+target, so replays, AI, and network-fed input are unchanged.