fix(pen): re-baseline zoom on pointer-count change; observe pen on child HWND

Zoom jumping (device: min 0.5 / max 2.47 while zooming near 1): the per-frame
scale clamp limited single-frame spikes but not multi-frame runs. Root cause is
pointer-count transitions — on Windows touch the two fingers land/lift at
different times and digitizers drop/re-acquire touches, and stock InteractiveViewer
keeps _scaleStart/_referenceFocalPoint from the OLD finger set, so the next frame
jumps. PenInteractiveViewer now re-baselines (and skips the transitional frame)
whenever details.pointerCount changes. The per-frame clamp stays as a secondary
guard.

Buttons (device evidence: btn=1 for tip-down, side-button, AND inverted; kind
never becomes invertedStylus): Flutter does NOT surface the barrel/eraser/inverted
state at all — unreachable from Dart. The only path is the native badnote/pen
plugin, which was SILENT because WM_POINTER is delivered to the Flutter CHILD
view window, not the top-level FlutterWindow where ObservePenMessage was hooked.
Fix: subclass the child HWND (SetWindowSubclass + comctl32) and observe its
WM_POINTER messages, passing every message through unchanged via DefSubclassProc
(observation-only, input behavior preserved). This is what should finally feed
GetPointerPenInfo penFlags + tilt to the channel — to be confirmed on-device with
the diagnostic (btn / kind / tilt readout).

Dart: analyze clean, 66/66 tests, linux build green. Native compiles on Windows CI.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/editor/canvas/pen_interactive_viewer.dart

@@ -91,6 +91,11 @@ class _PenInteractiveViewerState extends State<PenInteractiveViewer>
   double? _scaleStart;
   _GestureType? _gestureType;
 
+  /// Number of pointers in the active gesture. When it changes (a finger lands
+  /// or lifts, or a Windows touch dropout/re-acquire), we re-baseline instead of
+  /// applying a frame whose scale/focal still refer to the old finger set.
+  int _lastPointerCount = 0;
+
   // --- Matrix helpers (infinite boundary → no clamping to bounds) -----------
 
   Matrix4 _matrixTranslate(Matrix4 matrix, Offset translation) {
@@ -139,6 +144,7 @@ class _PenInteractiveViewerState extends State<PenInteractiveViewer>
       _scaleAnimation = null;
     }
     _gestureType = null;
+    _lastPointerCount = details.pointerCount;
     _scaleStart = _transformer.value.getMaxScaleOnAxis();
     _referenceFocalPoint = _transformer.toScene(details.localFocalPoint);
   }
@@ -146,6 +152,17 @@ class _PenInteractiveViewerState extends State<PenInteractiveViewer>
   void _onScaleUpdate(ScaleUpdateDetails details) {
     final double scale = _transformer.value.getMaxScaleOnAxis();
     _scaleAnimationFocalPoint = details.localFocalPoint;
+
+    // Re-baseline on any pointer-count change so a finger landing/lifting (or a
+    // Windows touch dropout) can't make scale/focal jump from the stale set.
+    // The transitional frame itself is skipped.
+    if (details.pointerCount != _lastPointerCount) {
+      _lastPointerCount = details.pointerCount;
+      _scaleStart = _transformer.value.getMaxScaleOnAxis();
+      _referenceFocalPoint = _transformer.toScene(details.localFocalPoint);
+      return;
+    }
+
     final Offset focalPointScene = _transformer.toScene(details.localFocalPoint);
 
     if (_gestureType == _GestureType.pan) {
@@ -200,6 +217,7 @@ class _PenInteractiveViewerState extends State<PenInteractiveViewer>
   void _onScaleEnd(ScaleEndDetails details) {
     _scaleStart = null;
     _referenceFocalPoint = null;
+    _lastPointerCount = 0;
     _animation?.removeListener(_handleInertiaAnimation);
     _scaleAnimation?.removeListener(_handleScaleAnimation);
     _controller.reset();