Reveal the reopened promotion submenu by keyboard when hover is dropped

[coneilen]

Summary

The UIA live gate reopens the sketch "Promote to" submenu after cancelling Turn
promotion. That reopen path only hovered, unlike the first open, which #631
gave a keyboard fallback. On a desktop that drops injected mouse input, local
windows-shell validation at ab47b464 failed with
Turn promotion submenu did not reopen natively, even though the shell owned
foreground and its native popup menu was open. This makes the reopen use the
same bounded keyboard reveal of the real native menu.

Changes

• uia-live-gate.ps1: after a failed hover, the Turn-promotion reopen
  hilites the real Promote to... item (MN_SELECTITEM) and sends VK_RIGHT
  via the existing RevealSubmenuByKeyboard. It then waits for the real
  submenu popup and logs UIA_SKETCH_SUBMENU_REOPEN with the path used.
• No timeouts were raised and no retries were added. The subsequent menu item
  click and the modal assertion are unchanged.
• ValidationRunner.Tests.ps1: a contract now requires the reopen path to use
  the keyboard fallback.

Test plan

RED: pwsh -NoProfile -File Tools\windows\Tests\ValidationRunner.Tests.ps1 with the new contract only -> exit 1; "UIA gate does not prove all sketch promotions and custody child through native interaction ..."
GREEN: pwsh -NoProfile -File Tools\windows\Tests\ValidationRunner.Tests.ps1 -> ValidationRunner.Tests.ps1: PASS; 384 multi-project contracts executed
REGRESSION: pwsh -NoProfile -File Tools\windows\validate.ps1 -Task windows-shell -SkipTrayLive -ShellValidationRoot C:\v7 -> failed (local desktop). Unit 55/55 sections, App 771/771, scrubbed startup 5/5 and the real-daemon round trip passed. The live gate then failed earlier, at the unchanged first open of sketch 1: the shell's native popup menu was already gone (no #32768 window owned by the shell), so neither hover nor keyboard reveal could act. Foreground stayed with GraphCode. This desktop drops injected input (see #631), and the failing step moves from run to run, so this local run neither proves nor disproves the change.

• Exact-head CI run 37556376613 passed windows-shell integration, including the live UIA gate. It logged UIA_SKETCH_SUBMENU_REOPEN title='UIA sketch 2' hoverRevealed=True keyboardReveal=False popup=True, so the new reopen code ran. Hover succeeded there, so the keyboard branch itself was exercised only locally, at the first open in the earlier run.

• The original local failure, at ab47b464 without this change, came from
  the same validation command. Unit 54/54 sections, App, scrubbed startup 5/5
  and the real-daemon round trip all passed. The gate then logged
  hoverRevealed=False keyboardReveal=True for the first sketch 2 open,
  and failed on the reopen.

• The gate script parses with zero errors.

• macOS make test and make check were not run; this change is
  Windows-harness-only.

Checklist

• I have read the Contributing Guidelines
• I have signed off my commits (git commit -s) per the DCO
• Tests pass locally (make test)
• Code follows the existing style (make check)
• I added the test/contract before the implementation and observed the intended RED failure