UI: seeded whole-window soak with memory and timing bounds

ui_soak_tests.rs drives the app through the egui test harness with seeded
random clicks, drags, keys (plain, Ctrl, Shift), typing and scrolling over the
sample deck. Every ten actions it checks that every document validates, the
selection is in range, undo, journal, thumbnail and texture caches stay
bounded, and no command or render panic was caught; at the end, that input
really reached the editor and the mean frame stays under 250 ms. Two seeds x
150 actions run in CI; DECKCRAFT_UI_SOAK_STEPS/SEED run it long.

Panics swallowed by the guards were invisible to tests: Session now counts
them (panics_caught) and deckcraft_render::panics_caught() counts render
panics drawn as blank. Textures::thumb_count exposes the thumbnail cache size.

Co-authored-by: Cursor <cursoragent@cursor.com>

crates/engine/src/guard.rs

@@ -52,6 +52,7 @@ impl Session {
                     st.revision = revision.max(st.revision).saturating_add(1);
                 }
                 log::error!("command `{id}` panicked: {msg}");
+                self.panics_caught = self.panics_caught.saturating_add(1);
                 if let Some(dir) = self.recovery_dir.clone()
                     && let Err(e) = crate::recovery::save(self, &dir)
                 {
@@ -85,6 +86,7 @@ mod tests {
         assert!(err.to_string().contains("test.panic") && err.to_string().contains("boom"), "{err}");
         let st = s.active().unwrap();
         assert!(std::sync::Arc::ptr_eq(&st.doc, &before), "the document is the one from before the command");
+        assert_eq!(s.panics_caught, 1, "the guard counts what it caught");
         // The session keeps working.
         s.execute("shape.insert", &json!({"preset": "ellipse", "rect": [36, 236, 200, 400]})).unwrap();
     }

crates/engine/src/lib.rs

@@ -351,6 +351,8 @@ pub struct Session {
     /// ends) instead of Windows and Linux (Ctrl+arrows by word or paragraph). Defaults to the
     /// platform DeckCraft was built for.
     pub mac_keys: bool,
+    /// Command panics caught by the guard (the document was rolled back); soak tests require 0.
+    pub panics_caught: u64,
 }
 
 impl Default for Session {
@@ -379,6 +381,7 @@ impl Session {
             media_status: Default::default(),
             gif_paused: Default::default(),
             mac_keys: cfg!(target_os = "macos"),
+            panics_caught: 0,
         }
     }
     /// A session with one new presentation open.