fix: fail on refused portal requests and catch black recordings

The portal reports refusals only in OBS's log; a denied, cancelled or failed
source selection now fails with an actionable reason instead of waiting
forever. check --expect-motion rejects black or frozen footage, and the
hardware script checks only runs that recorded, tests restore tokens in their
own step, and treats closing a window as informational: on Hyprland the
stream keeps its last frame, so sessions must end on game exit.

scripts/validate/linux-rig.sh

@@ -42,7 +42,7 @@ for codec in h264 hevc; do
     name="wayland-${codec}"
     dir="${out}/${name}"
     "${rig}" "${probe}" record --codec "${codec}" --seconds 9 --out "${dir}" > "${out}/${name}.log" 2>&1 \
-        && "${probe}" check --codec "${codec}" --out "${dir}" >> "${out}/${name}.log" 2>&1
+        && "${probe}" check --codec "${codec}" --expect-motion --out "${dir}" >> "${out}/${name}.log" 2>&1
     ok=$?
     volume="$(ffmpeg -v info -i "${dir}/session/segment-000001.mkv" -map 0:a -af volumedetect -f null - 2>&1 \
         | awk '/max_volume/ { print $5 }')"
@@ -54,7 +54,7 @@ done
 name=x11-window
 "${rig}" --x11 bash -c "'${probe}' record --target window --window \"\${CLIPBIN_RIG_GAME_WINDOW}\" --seconds 9 --out '${out}/${name}'" \
     > "${out}/${name}.log" 2>&1 \
-    && "${probe}" check --out "${out}/${name}" >> "${out}/${name}.log" 2>&1
+    && "${probe}" check --expect-motion --out "${out}/${name}" >> "${out}/${name}.log" 2>&1
 result "${name}" "$?"
 
 # expect_failure <name> <reason pattern>: recording started, then failed honestly.
@@ -101,13 +101,14 @@ else
     result "${name}" 1
 fi
 
-# 8. The portal grants nothing usable: recording never starts or claims to.
-name=portal-no-source
+# 8. The portal refuses the request: an actionable failure, never Recording.
+name=portal-refused
 CLIPBIN_RIG_PORTAL_OUTPUT=NO-SUCH-OUTPUT "${rig}" "${probe}" record --seconds 8 --out "${out}/${name}" \
     > "${out}/${name}.log" 2>&1
 probe_exit=$?
-if [[ "${probe_exit}" != 0 ]] && ! has "${out}/${name}.log" "status=Recording"; then
-    result "${name}" 0 "$(grep 'status=' "${out}/${name}.log" | tail -1)"
+if [[ "${probe_exit}" != 0 ]] && ! has "${out}/${name}.log" "status=Recording" \
+    && has "${out}/${name}.log" "status=failed reason=screen capture was not allowed"; then
+    result "${name}" 0 "$(grep -m1 -o 'status=failed reason=.*' "${out}/${name}.log")"
 else
     result "${name}" 1
 fi