Validate mask selectors for CSS compatibility in docs

The docs capture helper (`apps/docs/capture/capture.mjs`, `preShutter`) checks that each `mask` selector matches through Playwright, then joins all masks into one CSS `filter: blur` rule. If a mask uses Playwright-only syntax such as `:has-text("…")`, the match check passes, but the joined rule is invalid CSS, so the browser drops all of it. The shot is then taken with nothing blurred: owner names and person-identifying columns show. Seen in Task 10519: adding `a:has-text("GitHub (")` to the Credentials list mask left every owner name readable. Fix: refuse a mask the browser cannot parse as CSS (e.g. check `CSS.supports('selector(…)')` or apply one style rule per selector and verify each one), and say so in the error. Out of scope: changing any docs page, manifest or screenshot; the helper's sign-in or read-only guard. Done means: - A manifest whose mask uses `:has-text()` fails its shot with an error that names the selector. - A unit test in `apps/docs/capture/capture.test.mjs` covers that refusal. - `./dc check quick` is green.

preShutter now refuses a mask the browser can't parse as CSS (e.g. :has-text()), naming it in the error; unit + real-browser tests added. Quick gate green; PR #7099 queued to the merge lane. Memory: none applied.