test: verify WinCode 0.12.3 against real application evidence

[linnnn89]

Version 0.12.3 adds an opt-in real-application acceptance script for six TavernDesk navigation-to-source tasks. Candidate filenames are discovered by bounded native searches; the script then checks unique live controls, literal command assignments and method declaration snippets against current source hashes. It records native/MCP call counts, UTF-16 output characters, call time, repeated displayed lines and failures in local reports. Core and desktop check reports also retain actual TAP test/pass/fail/cancel/skip totals. No new dependencies or runtime feature expansion.

The isolated WPF source-repair test now carries the repository SDK policy and NuGet lock into its temporary checkout, keeping its offline restore locked. Skill guidance documents evidence reuse and fixed-profile testing, and the acceptance matrix distinguishes real application observations, controlled fixtures and unavailable integration conditions.

Validation:

• Core check: 300 passed, 1 existing optional skip, 0 failures/cancellations; typecheck, production stdio and delivery verification passed.
• Interactive desktop: 35/35. The WPF repair test passed again after SDK/lock propagation.
• Fixed-profile TavernDesk: six tasks passed, 12 native + 18 MCP calls, 67,103 UTF-16 characters; setup is counted separately. Eight explicit source-range scenarios and UI→assignment→method evidence passed.
• Actual background screenshot was inspected and readable; the current Codex connection remained Gateway 0.11.2 while its newly launched Host reported 0.12.3. Fresh stdio evidence is kept separate.

Limits remain explicit: no native-only performance comparison, universal token-saving claim, whole-method coverage, verified runtime binding or real Serena/C# semantic integration. No usable Serena command was found and none was installed. A user-imported card was verified read-only in the fixed test database and visually on the shelf; its description/first-message fields and managed cover were preserved. Two same-name UI text nodes correctly return complete-but-ambiguous without selecting a guessed subtree, also verified through newly loaded 0.12.3 production Gateway/Host handlers. Six navigation tasks passed again with the real card present (67,083 characters). Computer Use still misattributes the window to AiPPT; detail-page actions and chat were not tested. Existing Repomix alert #1 and branch-protection policy remain separate pending decisions. Review was author self-review without new agents. Exact-head Node 22/24 and CodeQL results are required before merge.