Flip WidgetHostNative off shell-core's Document onto
op_editor_core::EditorState. The host now owns one authoritative
state; every paint pass + hit-test reads a lazily-derived,
read-only Document snapshot (`paint_doc`), rebuilt via
op-pen-loader's pen_document_to_document + apply_editor_state_ui
whenever an `editor_state_dirty` flag is set.
Why: removes the dual-state strangler scaffold so the canonical
PenDocument model is the only editable state — input handlers
mutate EditorState, widgets stay read-only over the derived
Document. .op save now serializes editor_state.doc; load seeds
EditorState::from_document. shell-core's Document becomes a
paint-only target.
- op-editor-core: add host_support (EditorState::sample,
create_node_for_tool, replace_paths_with_polyline) + re-export
VariableScalar/VariableKind.
- shell-native: rewrite all 8 widget_host submodules onto
editor_state; split press.rs -> press_helpers.rs and keyboard
click routing -> click.rs to stay under the 800-line cap;
boolean_ops becomes a pure compute_boolean_op committed back
through EditorState.
- desktop: persistence / settings_io / chat_session /
model_discovery / main / frame move onto editor_state accessors.
f0bb56b6cd