Bound native hook stack use and scope hooks to foreground threads

Ignored and reentrant Edit messages previously entered a callback whose
large text buffers increased stack use on every nested call. Menu hook
forwarding also reserved payload buffers for unrelated messages. The
64-bit helper additionally installed desktop-wide hooks, allowing
background UI threads to acquire subclasses and introducing synchronous
traffic through Wine's mixed-architecture global hook chain.

Move Edit processing and menu payload construction into non-inlined
handlers. Keep the forwarding callbacks small, retain the busy-state and
destruction guards, and preserve application subclass chaining and ANSI/
Unicode text handling.

Share foreground hook ownership between the Winelib helper and 32-bit
host. Attach both hooks only to the matching foreground UI thread,
release them when that thread changes, and retry incomplete attachment
as a pair. Preserve existing Edit subclasses across foreground changes
and release host hooks during shutdown.

Add native 32-bit and 64-bit stack-budget fixtures covering ignored and
busy reentrant messages, menu forwarding, nested text queries, application
subclasses before and after attachment, text input, and destruction during
a text change. Add a foreground-scope integration fixture that verifies
background exclusion, thread switching, detachment, and reattachment.
Keep hook debug symbols and frame pointers for native crash diagnosis,
and document installation and live acceptance requirements.

Validation:
- CMake configure and parallel build; git diff --check.
- Hook-safety CTest and foreground-scope fixtures for both architectures.
- Existing menu fixtures and Edit late-attachment/restart checks for both
  architectures, plus the 32-bit list fixture and reader-timeout test.

These checks exercise specific stack and hook-scope defects; they do not
establish the cause of the live MUSHclient stack overflow. Audible speech,
physical braille, and live MUSHclient acceptance remain separate checks.

tests/README.md

@@ -1,5 +1,35 @@
 # Wine control integration
 
+## Native hook scope and stack use
+
+Run sequentially after building:
+
+```sh
+xvfb-run -a ctest --test-dir build -R hook-safety --output-on-failure
+xvfb-run -a python3 tests/menu_integration.py --build-dir build --fixture hooks
+xvfb-run -a python3 tests/menu_integration.py --build-dir build --fixture hooks --32-bit
+```
+
+The hook-safety test loads both actual DLLs in a disposable Wine prefix. It
+compares nested ANSI Edit calls with a minimal comctl32 subclass, checks the
+busy reentrant path and menu-hook forwarding stack, and exercises application
+subclasses installed before and after attachment, A/W text queries, typing and
+destruction during a text change. The scope fixture switches between UI threads
+and checks that only the foreground thread acquires new Edit subclasses.
+
+The original 32-bit callbacks fail the stack budget; the original global 64-bit
+hooks fail the background-thread check. These reproduce specific defects,
+without proving they caused the live MUSHclient stack overflow. Hook DLLs keep
+debug symbols and frame pointers to improve subsequent native stack captures.
+
+Also run the existing menu and editor tests for both architectures, including
+`--late-helper --restart-helper`, the 32-bit list fixture and the reader timeout
+test. For live acceptance, check MUSHclient typing, command history, incoming
+plugin speech, menu return and switching between Wine and Linux applications.
+Check Notepad, password exclusion and speech/braille separately. Loaded Edit
+subclasses pin the DLL, so testing an installed replacement requires restarting
+the affected Wine application as well as the helper.
+
 ## Reader reply stalls
 
 Run sequentially on a private X display:
@@ -170,7 +200,7 @@ MinGW's x86_64 and i686 C compilers, PyGObject, and `dbus-run-session`.
 
 The test creates a temporary Wine prefix and a private D-Bus service. Its
 64-bit PE application exercises the separately running Winelib helper's
-global menu hook, rather than calling helper functions inside the fixture.
+foreground menu hook, rather than calling helper functions inside the fixture.
 The test processes carry the managed-helper marker so the running Cthulhu
 supervisor does not start an additional helper in the test prefix.