test(vulkan): isolate the hardware witness lane

Tag the production offscreen witness as Lane=Vulkan, exclude capability-owned tests from the portable Release filter, and give lavapipe an explicit trait-only invocation after the portable Vulkan contracts.

Document the lane and pin witness, portable-filter, and workflow ownership without initializing Vulkan.

Mutations performed and restored:

1. Removed the witness trait: VulkanLaneOwnershipContractTests first failed Assert.Matches because the Lane=Vulkan/Fact/method pattern was absent.

2. Removed Lane!=Vulkan from the default filter: the contract first failed Assert.Contains, not found Lane!=Vulkan.

3. Weakened the dedicated invocation to Lane!=Vulkan: the contract first failed Assert.Contains, not found --filter Lane=Vulkan in the hardware step.

4. Narrowed the dedicated invocation with FullyQualifiedName: the contract first failed Assert.DoesNotContain because FullyQualifiedName was present at position 231.

.github/workflows/headless-portability.yml

@@ -311,7 +311,16 @@ jobs:
           dotnet test `
             tests/AcDream.App.Tests/AcDream.App.Tests.csproj `
             -c Release `
-            --filter "FullyQualifiedName~AcDream.App.Tests.Rendering.Gpu.Vk"
+            --filter "FullyQualifiedName~AcDream.App.Tests.Rendering.Gpu.Vk&Lane!=Vulkan"
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+
+      - name: Test the Vulkan hardware lane on lavapipe
+        shell: pwsh
+        run: |
+          dotnet test `
+            tests/AcDream.App.Tests/AcDream.App.Tests.csproj `
+            -c Release `
+            --filter "Lane=Vulkan"
           if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
 
       # (a) + (b): one run, two gates. The harness opens a real window, runs the