feat!: Reparent PasswordBox from TextBox to Control - #24038

Adds the composed shared text-input implementation that PasswordBox will
come to own, alongside the existing internal TextBoxView. ITextBoxHost
carries the architecture rationale, including why composition is used
rather than the shared base class WinUI itself has.

No implementation moves yet. TextBox implements the host contract and
holds a core; CanShowButton reads TextBoxCore.IsEmpty, which routes
control -> core -> host -> Text and so exercises the full loop.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Matches WinUI's projected hierarchy: `runtimeclass PasswordBox : Control`.
PasswordBox now composes a TextBoxCore through ITextBoxHost instead of
inheriting the whole text-input surface.

This closes the confidentiality leak. `OnPasswordChanged` no longer mirrors the
password into an inherited `Text` DP, so `passwordBox.Text` is gone rather than
returning cleartext, `TextChanged` no longer fires per keystroke, and
`BeforeTextChanging` can no longer observe -- or `Cancel` -- password input.

Also drops the ~16 `new`/`override` shadows that existed only to hide inherited
TextBox API. PasswordBox now declares its own Password, PasswordChar,
PasswordRevealMode, IsPasswordRevealButtonEnabled, Description, Header,
HeaderTemplate, PlaceholderText, InputScope, MaxLength, SelectionHighlightColor,
SelectionFlyout, CanPasteClipboardContent, PasswordChanged, ContextMenuOpening,
Paste, SelectAll() and PasteFromClipboard() -- the WinUI IDL surface, nothing more.
SelectedText, SelectionStart/Length, IsReadOnly, AcceptsReturn, TextWrapping,
CanUndo/CanRedo, Copy/CutSelectionToClipboard and ProofingMenuFlyout are gone,
and `is TextBox` is now false for a PasswordBox.

Items 11 and 12 are one commit because they cannot be split: the mirroring
writes TextProperty, which stops existing the moment the base type changes.

Two consumer sweeps were forced rather than deferred:

- TextCommandBarFlyout's ten `and not PasswordBox` guards became dead patterns
  (CS8121). The guards and the comments explaining the Uno-specific hierarchy
  both go.
- TextBoxView read everything through its `TextBox` property, which returns null
  for a reparented PasswordBox. `UpdatePasswordMasking` in particular would have
  left the mask frozen at whatever was last rendered -- silently, since every
  one of those paths is a null-conditional. It now reads the core, and
  GetPasswordChar comes through a new `ITextBoxHost.PasswordChar` instead of
  type-testing its way to a PasswordBox. Resolves the standing TODO that
  predicted exactly this.

RaiseValueAutomationEvents is deliberately empty: the shared implementation only
raised those when the peer was a TextBoxAutomationPeer, and a password box's peer
never was, so raising them now would be new behaviour rather than parity.

When_Copy_Cut_Does_Not_Leak_Password is rewritten to drive Ctrl+C/Ctrl+X through
the keyboard -- it encodes a security invariant, and the accelerator is the path a
user actually has now that the TextBox-only clipboard methods are gone.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

The override audit (pre-move override set vs the control's current one) found
PasswordBox missing five of TextBox's 35 overrides. Three are inert -- their
bodies call `base` plus a partial method that has no implementation anywhere and
was already dead before this work. Two were real:

- `UpdateVisualState` is the serious one. Without it, PasswordBox's own calls
  from OnVisibilityChanged/OnPointerEntered/OnPointerExited/OnPointerCaptureLost/
  OnIsEnabledChanged reached Control's implementation instead of the core's, so
  every visual state -- Normal/PointerOver/Focused/Disabled and the reveal
  button's visibility -- silently stopped working.
- `GetPlainText` supplies the automation name from Header/PlaceholderText.

Also: PasswordBox spell-checked its own masked text before the reparent, because
it inherited TextBox's IsSpellCheckEnabled (default true) and TextBoxView pushes
that onto the DisplayBlock. WinUI's PasswordBox has no such property and never
spell-checks, so the host answers false -- which changes rendering, and
When_PasswordChar_Visual_Comparison caught it as a deterministic 0.0511 RSMD
against a 0.05 threshold. The test compares a PasswordBox against a TextBox
showing the same letters, so it was asserting the old squiggly-underline parity;
both comparisons now disable spell-check on the TextBox so they isolate the mask
character, which is what they mean to test.

Reverted PasswordBox's InputScope default to Default. Password would have been
the better value but it is not what the inherited property defaulted to, and
changing it is not part of reparenting.

Given_TextBox + Given_PasswordBox: 235/235 passed, 4 skipped -- unchanged from
the pre-refactor baseline, now with PasswordBox deriving from Control.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Item 20. Every gate so far was a no-regression check; nothing asserted the
change's actual claim. Adds 7 tests to Given_PasswordBox (235 -> 242).

Four genuinely fail before the reparent and pass after:

- When_Derives_From_Control_Not_TextBox -- BaseType was TextBox
- When_TextBox_Only_Api_Is_Not_Reachable -- Text, SelectedText, SelectionStart/
  Length, IsReadOnly, AcceptsReturn, TextWrapping, CanUndo/CanRedo,
  ProofingMenuFlyout, Select, Copy/CutSelectionToClipboard, Undo/Redo,
  TextChanged/TextChanging/BeforeTextChanging/SelectionChanged/SelectionChanging
- When_Password_Is_Not_Reachable_As_Text -- Text returned the cleartext. Written
  as a sweep over every readable string-valued member rather than a hand-picked
  list, so a member added later is covered too.
- When_MaxLength_Matches_TextBox -- catches the old desync, where Password took
  an over-long value while the mirrored Text rejected it.

Three are regression guards rather than proof, since they also passed before:
When_WinUI_Surface_Is_Declared (the IDL surface, which items 22/23 can silently
erode), When_Password_Changes_PasswordChanged_Is_Raised, and
When_Automation_Does_Not_Expose_Password.

The hierarchy and surface assertions are deliberately not platform-gated: they
are WinUI-parity claims that hold on native WinUI too.

MaxLength is asserted as parity with TextBox rather than against a hard-coded
result. My first attempt asserted truncation and failed -- Uno's CoerceText
rejects an over-long value outright. Comparing the two controls to each other
tests what "behaviour preserved" means and holds whichever semantic the platform
picks, while still catching MaxLength doing nothing.

Given_TextBox + Given_PasswordBox: 242/242 passed, 4 skipped.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

The reparent left ten sites inside Uno.UI type-testing or casting to TextBox,
so each silently stopped serving a PasswordBox. All compiled green.

TextBlock.OwningTextBox is the significant one: typed as TextBox, it was null
for a reparented PasswordBox, which meant the display block reset its own
selection on every text change, dropped the caret-thickness width adjustment,
and stopped routing ContextRequested. Retyped to TextBoxCore, which is what it
actually needs and what serves both controls.

The rest route through a new ITextBoxHost.Core seam so a FrameworkElement can
reach the engine without naming a concrete control: TextControlFlyoutHelper
(ForceFocusLoss), ScrollViewer's touch-caret snap guard and its cast together,
XamlRoot.InvalidateOverlays, UIElement.ContextRequested's menu position,
TextBoxExtensions.InputReturnType, and the UIA TextAdapter/TextRangeAdapter
selection members. GetAdjustedTextAlignment now asks the host whether alignment
was set explicitly, so a PasswordBox answers no by construction rather than
querying a dependency property not registered for it.

Verified no-ops, deliberately left alone: both FocusManager sites (bodies are
entirely commented out), AriaMapper (IsPassword wins first), AutomationProperties
(both branches return "textbox", and the PasswordBox branch is ungated by a
linker hint), and all ten TextCommandBarFlyout guards removed earlier - every
one was `and not PasswordBox`, so `is TextBox` now excludes it naturally.

Adds a fails-before test: selecting in a PasswordBox and then rewriting the
mask lost the selection (Range(0,0) instead of Range(2,7)).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Three Skia runtime projects did not compile on this branch: Android (10
errors), Browser (6) and AppleUIKit (4). The four-build gate used through
items 5-12 never compiled any of them, so items 5 and 11 broke them silently.
Add all six runtimes to the gate.

The native overlay path was TextBox-typed end to end - IOverlayTextBoxView
took a TextBox, and TextBoxView.TextBox downcast the engine's owner - so a
reparented PasswordBox got null and every use was null-conditional, meaning
password entry through the invisible native text view would no-op rather than
throw. TextBoxView.TextBox is now deleted rather than retyped, so the type
system enforces this instead of a convention: IOverlayTextBoxView and
IInvisibleTextBoxView name TextBoxCore, and the iOS/Browser/Android
implementations follow.

Also fixed the a11y and IME consumers: WebAssemblyAccessibility's semantic
<input> value/selection sync, FocusSynchronizer, SemanticElementFactory,
Android's TextInputPlugin (its `textBox is PasswordBox` tests had become dead
patterns, which is what made the input type, autofill hint and sensitivity
flag wrong for a password field) and TextInputConnection's IME editable.

MacOSAccessibility's selection sync is the one site no build catches - that
project compiles green, so VoiceOver would just stop hearing about a password
box's selection changes.

ITextBoxHost gains PlaceholderText, IsPasswordRevealed and a SelectionChanged
notification, all of which existed as control-typed API the platform layers
were reaching for. Five core shims move from private to internal for the same
reason. Two latent nullable-reference errors surfaced in Android's autofill
path: TextBox.Text lives in a nullable-oblivious file, TextBoxCore.Text does
not.

Gate: Uno.UI.Skia, Uno.UI.Reference, Uno.UI.UnitTests, SamplesApp.Skia.Generic
and all six Skia runtimes build clean. Given_TextBox + Given_PasswordBox
243/243 (4 skipped); blast-radius filter 238/239 (9 skipped, the one failure
pre-existing). The platform-runtime changes are compile-verified only - no
runtime validation on iOS, WASM or Android.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

PasswordShouldNotDuplicateWhenRegainingFocus asserted against a string-keyed
DP lookup for "Text". That name resolves to nothing once PasswordBox stops
deriving from TextBox, so the assertion would compare "123123" against null -
and being string-keyed, no compiler catches it.

The same suite already uses SetDependencyPropertyValue("Password", ...) on the
autoGrow password box, so "Password" is the established convention here.

Swept exhaustively rather than by name: cross-referenced every string-keyed
Get/Set/WaitForDependencyPropertyValue call in SamplesApp.UITests against all
16 <PasswordBox> element names in the samples. This was the only wrong one.

The samples themselves need no changes - none of the 37 PasswordBox elements
sets a TextBox-only property and none binds to Text - so xstyler is not run,
as reformatting untouched XAML would only add noise.

Adds SamplesApp.UITests to the standing gate; it is in Uno.UI-Skia-only.slnf
but was not in the ten builds, which is the same gap one level out.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Follows the existing convention (see BC31): the PR number goes on the row
while the checkbox stays unticked until it merges.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

PR #23999 folded the UI-layer Reference flavor into Skia and merged every
`.skia.cs` partial into its base file, so `Uno.UI` now carries none of either
suffix. These files were added before that landed.

- `.skia.cs` dropped from the six new TextBox/PasswordBox/TextBoxCore partials;
  `PasswordBox.skia.cs` becomes `PasswordBox.Properties.cs`, mirroring
  `TextBox.Properties.cs`, since it holds public DPs rather than platform code
- the engine becomes `TextBoxCore.Input.cs` rather than folding into
  `TextBoxCore.cs`: the latter is `#nullable enable` and the engine is
  nullable-oblivious, so merging them would put 1881 unannotated lines under an
  annotated context and surface 40 latent warnings unrelated to this change
- `TextBoxCore.reference.cs` is deleted; `Uno.UI.csproj` is Skia-only, so a
  `.reference.cs` file no longer compiles anywhere, exactly as #23999 did with
  `TextBox.reference.cs`

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

CI's code-style analyzer flagged IDE0051 on TextBoxCore.OnKeyDownNonSkia.
It is genuinely unreachable: OnPostKeyDown only called it from a `#else`
branch, and Uno.UI.csproj is Skia-only since #23999, so `__SKIA__` is
defined for every target framework it builds.

Deletes the method and collapses OnPostKeyDown to forward directly. Also
drops a comment describing TextBoxCore.skia.cs and the Reference flavor,
neither of which exists after #23999.

Local builds could not have caught this: the ten-build gate passes
UnoFastDevBuild=true, which disables EnforceCodeStyleInBuild, and dropping
that flag is not sufficient either -- a net10.0 build with it removed still
emits zero IDE/CA diagnostics. CI's failing configuration is net11.0, which
global.json's allowPrerelease:false makes unselectable here.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

PasswordBox's public SelectionFlyout getter implicitly implemented
ITextBoxHost.SelectionFlyout, which emits it as virtual/final/newslot.
Uno.PackageDiff reports that vtable change as a removed method and fails
the Managed Binaries build. TextBox already forwards the member
explicitly, keeping its public getter non-virtual; do the same here.

Verified with generatepkgdiff against Uno.WinUI 6.6.184: the unmodified
package build reports "Removed method ... PasswordBox.get_SelectionFlyout()"
and exits with differences, while the same package carrying only this fix
compares clean. No PackageDiffIgnore.xml entry is required.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>