Audio: operator re-measure + format override (host<->hook op channel)

Add a per-stream op channel in AudioRingHeader (op_seq + op_* fields, version
2): the host posts re-measure / override commands, the hook applies them and
re-publishes (bumping format_generation), and the host rebuilds its render
client live on the change. The Audio panel (under Debug details) gains a
"Re-measure rate" button and a rate/channels/bit-depth/format override -- for
when detection is wrong or the channels/bit-depth were unrecoverable.

Also add a debug-only IPC test harness (-DCOOP_TEST_HARNESS, off by default,
absent from the shipped host): a file-based command channel that drives the
host's real UI code paths (inject / audio / re-measure / override / screenshot
/ status) for scripted validation, instead of unreliable synthetic mouse input.
Used to validate live: late-attach to coop_tone@44100 -> measured 44100,
promoted to hooked; override -> 2ch state, re-measure -> reconverge.

Trim the README roadmap to what's left; document the harness + rate_estimator_test.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

host/src/injection_panel.cpp

@@ -254,6 +254,24 @@ void InjectionPanel::reattach()
 	inject_selected();
 }
 
+#ifdef COOP_TEST_HARNESS
+unsigned long InjectionPanel::dev_inject_by_name(const std::wstring& image_name)
+{
+	refresh_processes();
+	for (const ProcessEntry& e : processes_)
+	{
+		if (iequals_name(e.exe_name, image_name))
+		{
+			selected_pid_ = e.pid;
+			selected_name_ = e.exe_name;
+			inject_selected();
+			return injected_ ? selected_pid_ : 0;
+		}
+	}
+	return 0;
+}
+#endif
+
 void InjectionPanel::publish(const std::array<PadInfo, kMaxPads>& pads)
 {
 	if (!test_input_.load(std::memory_order_relaxed))