fix: start the AT-SPI registry on the headless session before the shell

[timrichardson]

Fixes #3.

What this changes

A headless session's private dbus-daemon cannot activate at-spi2-registryd: the a11y broker routes the start through org.freedesktop.systemd1, and on a bus with no systemd that name is the stub answering /bin/false. So the headless a11y bus existed but no registry ever owned org.a11y.atspi.Registry, and every ui_* tool failed with "no application named ...". headless.py now spawns registryd itself, before the shell, because order matters: a registry that appears after the shell answers still leaves the self-test at 16/18 (the shell's atk-bridge stops retrying; apps started later were on the bus while gnome-shell was not, same session). The registryd is recorded in the state file and ended by stop(); --use-gnome-session also makes it exit with the bus.

How it was proven

• ruff check . clean
• python3 -m pytest -q — headless suite green, 398 passed (8 new unit tests for the spawn/liveness/degrade/stop paths)
• Live suites run on a real session: tests/test_headless_atspi.py (new, the scripted repro from headless session: the AT-SPI registry never starts, so ui_* tools fail with 'no application named ...' (self-test 16/18) #3 turned into a live check) — 2/3 on main (fails: registry not owned), 3/3 on this branch; tests/test_two_sessions.py not re-run, this change is inside the single-session start path it wraps
• DESKWRIGHT_SESSION=headless ./mcp_server.py --self-test — 18/18 on a cold start (was 16/18 on main); registry is up before the shell, which now registers like any primary-session app
• Extension not changed.

Anything a reviewer should be suspicious of

• Everything measured on one machine: Ubuntu 26.04, GNOME Shell 50.1, at-spi2-core 2.60.4, systemd 259. The dbus-broker-by-default switch is at-spi 2.59.0, so I expect Fedora/Arch on GNOME 50 to hit it too, but that is reasoning from the NEWS file, not a measurement.
• The 16/18-after-reorder run in the field notes came from reusing an already-running session whose registry came up after its shell; the 18/18 is from cold starts only. I could not force the shell to re-register on a live session, so "atk-bridge gives up" is inferred from one session's bus contents, not from at-spi source.
• _registryd_path() hardcodes /usr/share/dbus-1/accessibility-services/..., which is where every distro I checked installs it, but it is a fallback for a binary that is normally on PATH or in /usr/libexec.
• The registry-before-shell reorder sits between _seed_home and the shell spawn; if a future change moves it after the extension-readiness wait again, the self-test will say 16/18 and the reason will not be obvious. The comment block there says this in place.

Left in draft pending dog-food testing: running this as my daily headless driver for a few days before asking for review.