[Gerardo Malpartida (GerardoMal-ATG)]

Adds xmat.exe, a command line that analyzes existing captures without the GUI (#58), and parity checks that classify every discovered GUI entry point as supported, planned or GUI-only, so command-line support is tracked as features are added. It also hardens and speeds up the analysis code that both front ends now share.

Stacked on #156. This diff shows only the headless changes; it retargets to main when #156 merges. xmat opens captures through #156's checks, so it refuses the same files as the GUI.

Try it (from the build output, next to the GUI)

.\xmat.exe analyze capture.saz --out saz-results
.\xmat.exe analyze capture.xmatcap --out xmatcap-results --fail-on findings
.\xmat.exe analyze big.saz --out big-results --max-records 250000
.\xmat.exe doctor --for analyze
.\xmat.exe help

Commits (each builds and passes tests)

1. UI tests clean up their storage.
2. Shared analysis: the GUI analyzer becomes an adapter over AnalyzeCaptureOperation, with bounded SAZ reading, faster rules under a shared work budget, and repeated and polling calls grouped by their exact request body.
3. Save refuses to overwrite an open capture and replaces files atomically.
4. The xmat command line (analyze, doctor, JSON output, exit codes, --max-* limits), the parity checks, docs/cli.md and CONTRIBUTING.
5. CI ships and smoke-runs xmat.exe.

Please review first

• docs/cli.md: exit codes, the xmat-cli/1 and xmat-analysis/1 JSON, limits and budgets.
• CONTRIBUTING: the parity gate and the shared operations layer.
• Edits to existing code (50 files, +6,020/−739): the GUI analyzer adapter, rules engine and rules, data layer and Save.
• The safety and contract tests. Only the bulk fixture data can be skimmed.

GUI behavior changes

• Small-Batch Detection keeps its statistics per run instead of accumulating them across consoles.
• Two different request bodies sent to the same URI are no longer counted together as repeated or polling calls when their old 32-bit hashes collide.
• A capture that exceeds the analysis budget fails with an error instead of continuing unbounded rule evaluation. In testing, a regular 1 Hz polling fixture (same URI and body) completed at 75 minutes and exceeded the budget at 90; that is an observation, not a duration cutoff.
• Saving over a capture that is open in a tab is refused with an error message, and saves replace files atomically.
• Otherwise, on four capture fixtures, including a 486-call capture, GUI analysis produces the same reports as Harden capture file open and import #156. Report entry order already varies between runs on main.

Limits: 512 MiB input, 256 MiB data, 32 MiB per record and 100,000 records by default, raisable to 2,048, 512, 128 and 250,000. On the input-limit test corpus, runs at the defaults stayed under 1.4 GiB and 15 seconds, and at the maximums under 2.4 GiB and 25 seconds. These are observations, not bounds: run xmat with time and memory limits. --out must be on storage with Windows permissions, such as NTFS.

Not in this PR: command-line versions of live capture, sanitized conversion, HTML reports and network-trace analysis; the GUI already has these. docs/cli.md lists them as planned, and xmat rejects them as unknown commands until they ship.

Once this merges, a PR that adds GUI commands or windows (for example #145) also classifies each new entry point in CapabilityRegistry.cs; the parity test names any it misses.