Add Xorg Remote controller capture with a core F11 escape

The Xorg command owner gains an exclusive Remote capture mode. Native
transitions pass through the repeat normalizer and capture router;
forwarded keys leave as remote.input events, Remote's own shortcuts are
dispatched locally, and F11 ends capture on the X thread. Reader policy,
overflow or inconsistent input also end it. Ending releases forwarded
keys first and keeps the grab until held keys are released. Local key
echo is suppressed during capture. The app attaches the owner to
sessions installed with keyboard-capture.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/tentacle-remote-capture.md

@@ -1,8 +1,8 @@
 # Remote controller keyboard capture IPC
 
 Protocol 1.1 now carries controller keyboard capture between the reader and a
-Remote Tentacle. This document describes the wire contract and host checks;
-native capture is described in the following sections as it is implemented.
+Remote Tentacle, and the Xorg command owner provides the exclusive capture
+itself. Live physical-keyboard acceptance is pending.
 
 ## Wire contract
 
@@ -48,3 +48,48 @@ event kinds. Revocation drains pending focus work.
 Go/Python SDK-process tests cover owner absence, admission and replay,
 role/grant denial, invalid parameters, saturation revocation, event delivery
 and rejection after revocation.
+
+## Xorg capture owner
+
+`CommandListener.BeginRemoteCapture` adds a third exclusive mode to the Xorg
+command owner, next to internal reader UI and learn mode. It starts only
+between chords, while command grabs are allowed and no other mode is active,
+and takes `XGrabKeyboard` on the root window without changing input focus.
+Each native transition passes through `RemoteRepeatNormalizer` and
+`RemoteCaptureRouter`. Ordinary keys and Cthulhu modifier chords become
+`remote.input` events; the router releases a forwarded prefix remotely before a
+local chord. Keys outside the Remote vocabulary are consumed locally.
+
+Only two things stay local. The core escape, F11 with no modifiers, ends capture
+on the X thread without waiting for a Tentacle or the network. Commands whose
+IDs start with the requesting Tentacle's `tentacle/<session>/` prefix, as
+resolved from current bindings including remaps, are dispatched through the
+normal command queue. Lock, secure input, XTerm handoff, learn mode, OCR review,
+a device hierarchy change, an inconsistent stream or a full 512-event queue end
+capture with reason `local`.
+
+Ending releases every forwarded key through the stream, newest first, then
+sends the end marker and closes the stream. Keys still physically held keep the
+grab until their releases arrive, so no release reaches an application that
+never saw the press. While capture is active the XRecord listener's local key
+echo and speech interruption are suppressed.
+
+`start_remote_capture` attaches this owner for sessions installed with
+`keyboard-capture`, from both local launch and managed startup. It enters
+capture only for a current controller lease while the reader is unlocked, not
+handed off and showing no reader UI. Revocation of the lease ends capture.
+
+A private Xvfb test drives XTEST keys into the real owner with a focused `xev`
+window as the local application: plain keys, Shift+Tab and a reader-modifier
+chord are forwarded with correct names and pairing; the Remote shortcut stays
+local and withdraws its prefix; unsupported keys and F11 are consumed; and the
+window receives none of the captured keys but does receive input afterwards.
+Lock ends capture with a held modifier released remotely. Five repeated runs
+passed. App tests with a synthetic owner and a real Go SDK child cover focus
+reporting, key forwarding, escape and requested exit, revocation, policy
+denial and grab failure.
+
+Known limits: the escape is a fixed chord and is not remappable; a withdrawn
+prefix reaches the remote as a modifier tap; XTEST input cannot establish
+physical-keyboard behaviour; and Caps Lock as the Cthulhu modifier keeps its
+local lock state but is forwarded as a key.