feat: headless test harness for models

[meszmate]

Stacked on #132 — base branch is feat/fallible-model-callbacks, so this diff only shows the harness. Merge #132 first and GitHub will retarget this to main.

Also from the codebase review.

Why

Testing a ZigZag application means standing up a terminal, so in practice apps only test their components — never the model that wires them together. The library's own tests/program_tests.zig can only assert on allocator plumbing for the same reason.

zz.testing.Harness runs the same Model-Update-View cycle without a terminal:

test "pressing + increments the counter" {
    var h = try zz.testing.Harness(Model).init(testing.allocator, testing.io, .{});
    defer h.deinit();

    try h.start();
    try h.pressChar('+');
    try h.pressChar('+');

    try testing.expectEqual(@as(i32, 2), h.model.count);
    try testing.expect(try h.viewContains("Count: 2"));
}

start()	runs Model.init and processes the command it returns
send(msg)	delivers a message, following any command it produces
press / pressChar / typeText	key input
mouse(event)	mouse input
resize(w, h)	changes the context size, sends window_size
advance(ns)	moves the clock and delivers timers that came due
nextFrame(ns)	starts a frame, resetting the frame allocator
view() / plainView() / viewContains(s)	the rendered frame, styled or not
hasQuit()	whether the model returned .quit
recordedEffects() / title()	commands the terminal would have run

Terminal-only commands (set_title, println, images, mouse toggles) are recorded rather than executed, so a test can assert on them. Timers run off an explicit clock, so a repeating tick is exercised without waiting for it.

The frame allocator is reset by nextFrame/advance exactly as the runtime resets it each tick — a model that keeps a frame-allocated slice across frames fails here instead of in production. (That is the bug fixed in #126.)

Pairs with the existing expectSnapshot for golden-file rendering tests.

Note on the design

The harness deliberately does not reuse Program's command loop. It only handles the commands a model can observe (quit, tick, every, batch, sequence, msg, perform) and records the rest — which is what a test double should do, and keeps it independent of terminal state.

model.ErrorSet names a callback's error set. The harness needs it to declare its own Error type: send and process call each other, and Zig cannot infer two error sets that depend on one another.

Tests

tests/harness_tests.zig — 12 cases covering initial render, key/mouse/type input, quit, .msg commands being re-dispatched rather than recorded, recorded effects, repeating timers, resize, styled vs plain view, frame-allocator reset across 500 frames, and a model with plain (non-fallible) callbacks.

Writing them turned up a separate real bug in the library's batch API — see the follow-up PR.

zig build test and zig build clean on 0.16.0.