Fix the dead win7 context menu, flatten the selection, add a tab menu

Right-click did nothing under the win7 skin, and then swallowed the next
click. 7.css declares `position: relative` on ul[role=menu] and the `skin`
layer outranks `utilities`, so Tailwind's `.fixed` lost: [style.left/top.px]
became flow offsets from the menu's static position — the last child of the
h-screen frame — and every menu rendered below the viewport, unreachable
behind overflow:hidden. Its backdrop is a plain <div>, unmatched by 7.css, so
that stayed genuinely fixed and ate the following click. Regressed in 0ae2a62,
when the menu adopted 7.css's real markup.

Restated `position: fixed` in skinfix, scoped to a new `w7-ctx` marker so
7.css's own menus keep theirs. scripts/menu-probe.ts is the regression test:
it renders the menu at declared coordinates, pixel-scans whether it landed
there, and carries a marker-less control menu (the bug verbatim) as its own
discriminator. A resting pixel diff cannot see this class of bug.

Selection band goes flat: --w7-sel-bg/-bd (#cbe8f6/#26a0da) is what Explorer
actually painted, where 7.css reused --w7-el-grad-h, its Aero element-hover
ramp. That var is left alone — buttons and tabs still want the gloss. The
unfocused pane gets the grey idle band; the band still never disappears with
focus, it only weakens. Harness diff confirms the change touches selection
rows and nothing else, in both themes.

New workspace-tab right-click menu in both skins: New Tab, Close Tab, Close
Other Tabs, Close Tabs to the Right, Disconnect. The target id travels inside
the action string because the right-clicked tab is not necessarily the active
one. Illegal entries are disabled rather than omitted, the way Win7 greyed
out — and since 7.css's [aria-disabled] handling is CSS-only, the keyboard
paths check the flag themselves.

Co-Authored-By: Claude <noreply@anthropic.com>

docs/gotchas.md

@@ -160,6 +160,22 @@ touching the adjacent code.
   `:root.win7` and overridden in **both** dark blocks (the `[data-theme]`
   attribute one *and* the `prefers-color-scheme` one; system dark sets no
   attribute).
+- **The skin layer can also override `position`, and that breaks LAYOUT, not
+  just paint.** `ul[role=menu]` carries `position: relative` in 7.css (for the
+  gutter stripe's `::before` and submenu anchoring), which outranked Tailwind's
+  `.fixed` on the app's own context menu. `[style.left/top.px]` then became
+  *flow* offsets from the menu's static position — the last child of the
+  `h-screen` frame — so every right-click menu rendered below the viewport,
+  unreachable behind `overflow: hidden`. The backdrop is a plain `<div>`, which
+  7.css does not match, so it stayed genuinely fixed and ate the next click:
+  the symptom was "right-click does nothing, then the app ignores me once".
+  Fixed with a `position: fixed` restatement in `skinfix`, scoped to a `w7-ctx`
+  marker class so 7.css's own menus keep theirs. Regressed in `0ae2a62`, when
+  the menu root became a real `ul[role=menu]` — i.e. adopting the framework's
+  markup is what exposed it. **A resting pixel diff cannot catch this class of
+  bug**: nothing about the idle window changes. `scripts/menu-probe.ts` renders
+  the menu at declared coordinates and scans whether it landed there, with a
+  marker-less control menu as its own discriminator.
 - **Its selectors are exact, and a near-miss looks exactly like "7.css doesn't
   support this".** `menu[role=tablist] button` is a DESCENDANT selector, so
   every button inside the strip becomes a tab — the `+` and the right-hand
@@ -231,7 +247,19 @@ touching the adjacent code.
   Kill first (`pkill -f dev-linux-x64`), confirm with
   `pgrep -cf 'dev-linux-x64/miniSCP-dev/bin/launcher'`, then launch and capture.
   Note `pkill -f 'electrobun dev'` also matches the shell running it and kills
-  your own command (exit 144) — match on the build path instead.
+  your own command (exit 144) — match on the build path instead. That is only
+  half the trap: `pkill -f dev-linux-x64` does the same thing, because the
+  pattern appears in the killing command's OWN argv. Break the literal with a
+  character class — `pkill -f 'dev-linux-x[6]4'` — the way `ps | grep [x]yz`
+  has always worked.
+- **Prefer the headless probes over launching the app.** `bun run start` opens a
+  real window that takes focus, which interrupts whatever the user is doing;
+  there is no Xvfb/xvfb-run on this machine and Wayland offers no
+  launch-without-focus. `scripts/shot.ts` (+ `--dark`), `hover-probe.ts` and
+  `menu-probe.ts` all render through headless Firefox and open nothing. Launch
+  the real app only for what Gecko genuinely cannot answer — WebKitGTK
+  behaviour, the native frame, transparency, live RPC — ask first, and batch
+  every live check into a single launch.
 - **X11 capture cannot answer "is this pixel transparent?"** for the frameless
   window. `import -window` grabs the window's own pixels with no compositing,
   so a transparent corner and an opaque black one both come out black;