Capture driver forwards null RefusalSnapshot to [ref] parameter, failing live capture #862

Problem

Live capture C2 on main b70c3bf5 failed in the worker with:

ParameterBindingArgumentTransformationException on parameter 'RefusalSnapshot': Reference type is expected in argument.

#850 (206a7dbc) added an optional [ref]$RefusalSnapshot parameter to Find-CapAutomationElement (Tools/windows/UiCaptureDriver.psm1). It forwards that parameter unconditionally to Resolve-CapAutomationCandidate -RefusalSnapshot $RefusalSnapshot.

Two callers do not pass it:

• UiCaptureDriver.psm1:1390, the Graph root lookup;
• UiCaptureDriver.psm1:1461, the spec element lookup.

So $null is bound to a [ref] parameter, and PowerShell throws before the resolver runs. Only the worker's polling caller (Invoke-UiCaptureWorker.ps1:505) supplies a [ref].

A minimal reproduction in pwsh 7:

function Inner { param([ref]$R) }
function Outer { param([ref]$R) Inner -R $R }
Outer   # ParameterBindingArgumentTransformationException

The unit suite did not catch this because UiCaptureDriver.Tests.ps1 substitutes Find-CapAutomationElement at these call sites, so the real forwarding path never runs without a [ref].

Ask

1. Forward RefusalSnapshot (and RefusalContext, if it has the same shape) only when the caller bound it.
2. Add a test that calls the real Find-CapAutomationElement with no RefusalSnapshot argument through the forwarding path. It must fail on main with this exception.
3. Preserve the Retain bounded selector-refusal evidence without observing successful waits #850 refusal-evidence behaviour for callers that do pass a [ref].

Refs #848, #850