fix: sync native brightness changes from macOS

[sampotts]

Summary

Brightness changes made with macOS keys or System Settings did not reach Display Groups. Native brightness control was also restricted to built-in panels, skipping Pro Display XDR and Studio Display.

Probe native control before falling back to DDC/software, and observe grouped native displays with a 50 ms polling interval, including while the menu is closed. Feed external changes through the existing group policy. Serialize native writes and baseline their readback to suppress feedback loops and stale reads. Remove leftover software dimming when native control becomes available.

Closes #41

Type of change

• Bug fix
• Feature
• Refactor / internal
• Docs
• Lifecycle / recovery / safety (requires threat & recovery review)

Checklist

• Clean-room: Original work; no proprietary code, copied UI, copy, or assets.
• Tests added for initial baselines, external changes, own-write suppression, overlapping reads, failed readback, and invalid samples.
• make test passes locally (swift test green) and SwiftLint is clean.
• The public-API-only build still compiles with experimental providers absent (NFR-010).
• Docs updated where behavior changed.
• Commits are signed off (git commit -s, DCO).

Validation: All 656 unit tests passed, and the four brightness-monitor tests passed again before submission. Both OpenDisplay and OpenDisplay-PublicAPIOnly built successfully with Xcode. SwiftLint reports the same 372 violations as upstream main (360 warnings, 12 errors), so the combined lint checklist item remains unchecked. git diff --check passes.

Hardware evidence: Native DisplayServices brightness reads succeeded on both connected Apple external displays. The reported setup and reproduction are in #41. This does not claim automated end-to-end keyboard/System Settings validation. Observation is limited to native brightness; DDC-only monitor-button changes are outside this fix.

Safety & recovery

• This PR does not touch lifecycle, the transaction coordinator, checkpoints, the rescue path, startup, IPC, capture, update, or network.
• Relevant behavior and failure handling are described below; maintainer threat/recovery review is requested for the background native IPC polling.

The new loop starts when active brightness-group members are present, stops when none remain, and is cancelled on app termination. Reads run off the main actor; sleeping displays, failed reads, and stale observations are skipped. Native writes are serialized per display and read back before resetting the observer baseline. Existing group precedence and offset learning remain in place. The loop does not change display topology or recovery behavior, and is excluded from the public-API-only build.