feat(agent): v2 secure-session-core Task 6 - full key fidelity

SPEC-002 Phase 1 Task 6, code-reviewed APPROVED (2 rounds), locally verified
(cargo fmt + clippy -D warnings exit 0 + cargo test --workspace 70 pass + build).

- Viewer WH_KEYBOARD_LL hook diverts system combos (Win/Win+R, Alt+Tab, Alt+Esc,
  Ctrl+Esc) to the remote as a full KeyEvent (vk + scan + is_extended + modifiers)
  and suppresses local handling - GATED on the viewer window having focus AND a
  "send system keys" toggle (default on; Pause/Break host-key), so it never bricks
  the technician's local keyboard when unfocused.
- Agent injection via SendInput KEYEVENTF_SCANCODE + correct KEYEVENTF_EXTENDEDKEY
  (right Ctrl/Alt, arrows, nav, Win, NumLock, numpad Divide) - layout-independent,
  extended-key-correct.
- Ctrl+Alt+Del completes through the SAS helper (SYSTEM SendSAS); installer sets
  the SoftwareSASGeneration policy; 3-tier fail-loud (no false success). SAS named
  pipe DACL tightened from NULL/Everyone to Authenticated Users.
- Modifier hygiene: viewer emits key-ups for held Ctrl/Alt/Shift/Win on focus loss
  / close so modifiers never stick on the remote.
- proto: KeyEvent.is_extended = 7 (additive; older agents derive the flag).

Closes Win+R / Ctrl+C-V / Ctrl+Alt+Del / arrows-vs-numpad fidelity. Live on-device
testing is plan Task 8.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

proto/guruconnect.proto

@@ -148,6 +148,13 @@ message KeyEvent {
     uint32 scan_code = 4;       // Hardware scan code
     string unicode = 5;         // Unicode character (for text input)
     Modifiers modifiers = 6;
+    // True when the originating key is an "extended" key (right Ctrl/Alt, arrows,
+    // Insert/Home/End/PageUp/Down, NumLock, Win keys, numpad Divide). The viewer
+    // captures this from the low-level hook (KBDLLHOOKSTRUCT.flags & LLKHF_EXTENDED);
+    // the agent injects with KEYEVENTF_EXTENDEDKEY when set. Field added in Task 6
+    // (v2 full key fidelity); older agents that ignore it fall back to deriving the
+    // flag from vk_code/scan_code.
+    bool is_extended = 7;
 }
 
 enum KeyEventType {