Make headless testability a birth requirement, and prove it in the gate

[iderex]

This is the property that is impossible to add later. A suite that grew up
assuming a display, a keychain prompt, or an administrator will not be made
headless afterwards without rewriting the tests that matter most, and by then
somebody will argue that the ones needing a display are the important ones.

The requirement is stated once, here, and every test written on this board
inherits it. Every planned test runs with no display server present and with no
elevated privileges. A test that needs either is a defect in the test rather than
a step to document.

There is a concrete case worth naming so nobody rediscovers it. Binding a socket
to a machine's own interface address rather than to loopback triggers a firewall
consent dialog on Windows, the dialog is answered by an administrator, and its
subject is the executable's full path, so answering it settles nothing for the
next build directory. A test that needs that bind belongs in the separate harness
in #22.

Done when

The gate's test check runs on a runner with no display server, as a
non-elevated user, and with no network access to anything but a loopback address.
A test that opens a display, requests elevation, or binds to a non-loopback
address fails there. The rule is written in CONTRIBUTING.md with the reason.
Blocked on #16.