Put a drag down when it is taken away, and stop keeping two dev stacks

Three things the review found.

A drag ended anywhere other than a `pointerup` left the bar painted for the
rest of the session. Escape, a pen leaving the tablet, the browser taking a
touch back: all of them end a drag through `pointercancel`, none of them
reached `onPointerUp`, and `data-dragging` stayed set with no pointer anywhere
near the handle — which is the acceptance line about handles being invisible
until pointed at, broken by the mechanism that keeps them visible while they
are being used. `lostpointercapture` is now the only place a drag ends,
because capture is released implicitly by every one of those and by an
ordinary release too, so there is one path instead of one path and some
exceptions.

The test for it is worth reading before changing. Written the obvious way —
release capture, let go, look — it passes against the bug: a handle follows
the pointer for as long as the drag is working, so it is under the pointer the
whole way and the `pointerup` at the end lands on it however far the drag
went. Clearing the state there therefore looks correct in every case except
the one that matters. The pointer has to be somewhere else when the button
comes up, which is what an interruption actually leaves behind, and only then
does the assertion mean anything. Confirmed by running it against the previous
code, where it reports the bar at full opacity.

`scripts/shoot-shell.ts` had been forked from `scripts/check-dev-console.ts`,
down to the comments — two copies of the same Vite-plus-server bootstrap that
would have had to be kept in step by whoever next changed either. It is
`scripts/stack.ts` now, started by both, and it takes the two halves down
together if only one of them came up. The scripts lost 87 and 99 lines. The
console check still reports 8 of 8, and the screenshots come out byte for byte
what they were, which is the evidence that this moved nothing.

"The document page is the only element with a shadow" was being read as three
assertions on the shell's own layers, which would have passed on a shell that
had grown a fourth. Every element in the document is asked now, and the answer
has to be a list of one — and it names an offender rather than counting them,
so a shadow put back on a rail says which rail. That is true of a room at
rest, which is the honest scope of it: five surfaces in the product take a
shadow when they appear, and the task file now says which task owns each. Four
have one — 008 for the menu and the bubble, 009 for the notice pill, and the
table grips are a ring drawn in `box-shadow` because a `<table>` cannot hold a
`<div>` to put a border on. The agent's change bar and its list have no task
at all, and that is written down where whoever takes 009 will see it rather
than left for them to rediscover.

`bun run ci` still fails on CODE_OF_CONDUCT.md, LICENSE.md and SECURITY.md,
which this branch does not touch and which have been unformatted since they
were added.