test(device): replay a keyboard capture session through the shared skeleton

The gesture replay test drove run_capture through the gesture adapter only. The keyboard adapter, which now hands run_capture an ArmedKeys instead of running its own copy of the lifecycle, had a unit test for its edge decoder and nothing else — and the move changed one thing about it that can be observed: the keyboard session publishes its channel slot before the listener and the 0x1d4b lookup, as the gesture session always did, instead of after them.

The new test drives run_keyboard_capture_session over the same replay node with one wanted control (Mute), holds the 0x1d4b lookup and asserts the slot is published and current by then, then shuts the session down and checks Restored, a cleared slot, a retained publication, one channel open and exactly two reporting writes: 0x23 (divert valid and on, raw XY valid and off) on arming and 0x22 on restore, both preserving the original remap.

ArmedReplay is the enumerate, hold, stop and assert driver both capture tests now share, and the cassette helpers take the control ID and capability flags instead of assuming the gesture button.