Wire native undo into menus, toolbar, and command validation

The command surface was already almost entirely platform machinery —
this card proves it and pins it. Headless probes established that
NSWindow.validateMenuItem answers enablement AND rewrites the row title
from the delegate-supplied manager, so 'Undo Move 3 Cards' flows step
phrase to Edit menu with no code of ours; under the lock the rows dim
and keep their names, the correct reading of the-stack-survives. The
toolbar twins validate through validateUserInterfaceItem, which never
touches labels — 03's static-label exception proven rather than
asserted — and their specs' enablement abstention is pinned so nobody
later adds a second, disagreeing answer. The one link a headless run
cannot close is the nil-target key-window resolution itself: standard
responder-chain behavior with none of our code in it, left as the
manual check. Base-edition 'disabled without undo' scaffolding is
reworded away — every base board has undo now. New suites cover the
trash's two doors (delete-then-undo byte-identical to Put Back's
effect), position-preserving restore of a middle card, and the
capstone: five gestures forward, five presses back to the origin
board, five forward again, the menu phrase asserted after every press.

Claude-Session: https://claude.ai/code/session_01SR4XGjmBE16ZUYWpfFHXwY

Kanban/App/AppModel.swift

@@ -194,15 +194,15 @@ public final class AppModel {
     /// **The composition root for `HistoryProviding`** (12-editions.md ▸ The provider seam): what a
     /// board session's undo stack is built by, called once per board as its session begins.
     ///
-    /// Base binds the native stack — an `NSUndoManager` over inverse `WriteOperation`s
-    /// (13-native-undo.md) — and that is the default here because it is the *shared* code's
-    /// implementation: both targets compile it, and Pro runs it too until pro-m1 replaces this
-    /// closure with the git provider (06-history-undo.md). Nothing in this file is
-    /// edition-conditional; the edition difference is which closure the root installs.
+    /// Base binds the native stack — a pair of step stacks over the inverses registered at the
+    /// Writer boundary (13-native-undo.md, `NativeHistoryProvider`) — and that is the default here
+    /// because it is the *shared* code's implementation: both targets compile it, and Pro runs it
+    /// too until pro-m1 replaces this closure with the git provider (06-history-undo.md). Nothing in
+    /// this file is edition-conditional; the edition difference is which closure the root installs.
     ///
     /// It takes the store because that is what a provider is a history *of*: the git provider needs
-    /// the board root it is a repository at, and the native one is about to need the same store's
-    /// snapshots to compute inverses from. A property rather than an initializer argument so a test
+    /// the board root it is a repository at, and the native one's steps are computed from the same
+    /// store's snapshots. A property rather than an initializer argument so a test
     /// can bind a fake without a second `AppModel` initializer, `@ObservationIgnored` because
     /// nothing renders from it.
     @ObservationIgnored