UI: seeded whole-window soak with memory and timing bounds

ui_soak_tests.rs drives the app through the egui test harness with seeded
random clicks, drags, keys (plain, Ctrl, Shift), typing and scrolling over the
sample deck. Every ten actions it checks that every document validates, the
selection is in range, undo, journal, thumbnail and texture caches stay
bounded, and no command or render panic was caught; at the end, that input
really reached the editor and the mean frame stays under 250 ms. Two seeds x
150 actions run in CI; DECKCRAFT_UI_SOAK_STEPS/SEED run it long.

Panics swallowed by the guards were invisible to tests: Session now counts
them (panics_caught) and deckcraft_render::panics_caught() counts render
panics drawn as blank. Textures::thumb_count exposes the thumbnail cache size.

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/gaps.md

@@ -48,11 +48,14 @@ revision history.
 - **Estimate:** 4–8 h (backend probing outside the process or a safe-mode fallback, a software
   renderer path). Needs a tester with the hardware. **Beta blocker.**
 
-### No soak or long-session testing
-- **Evidence:** unit tests (504), PPTX malformed/fuzz tests and the command panic guard exist; no
-  random command sequences over big decks, no memory or undo-depth soak.
-- **Impact:** unknown crash and slowdown rate in long sessions.
-- **Estimate:** 4–8 h.
+### Soak testing is new
+- **Evidence:** `crates/ui-egui/src/ui_soak_tests.rs` drives the whole window with seeded random
+  clicks, drags, keys (plain, Ctrl, Shift), typing and scrolling over the sample deck, checking
+  document validity, bounded undo/journal/thumbnail/texture caches, zero caught command and
+  render panics (`Session::panics_caught`, `deckcraft_render::panics_caught`) and a mean frame
+  under 250 ms; 4 × 3000-action runs are clean. Engine-level command soak: PR #502.
+- **Impact:** long-session crash rate is sampled in CI; RSS is not measured directly.
+- **Estimate:** 1–2 h (RSS sampling per platform).
 
 ## File formats