fix(vmgui): pre-flight X display, stop failing silently

`vmgui` sent the child's stderr to /dev/null, so when the X display was
unreachable (the common case: sudo -u ci-runner loses the desktop user's
XAUTHORITY and xhost wasn't granted) the GUI died with "cannot open display"
and the command still printed success — "nothing opens".

Now it:
- pre-flights the display with xdpyinfo and aborts with the exact
  `xhost +SI:localuser:ci-runner` hint instead of spawning a doomed process;
- drops an inherited XAUTHORITY that this user can't read (falls back to
  host-based xhost auth);
- logs the GUI's stdio to /tmp/vmgui-*.log and grace-polls 1.5s, surfacing the
  log if the GUI exits immediately;
- errors (non-zero) when no DISPLAY is resolvable.

Runbook §4.7 updated with the "if nothing opens" guidance. 13 tests; green ≥90%.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/RUNBOOK-PhaseC.md

@@ -216,22 +216,24 @@ ci vm cleanup --max-age-hours 4 --lock-file /var/lib/ci/vm-start.lock
 Launches the **interactive** VMware Workstation GUI (not the headless vmrun path)
 so you can watch/poke a clone by hand.
 
+**Required once per desktop session** — authorise `ci-runner` on your X server
+(run as YOUR logged-in user, not ci-runner):
 ```bash
-# authorise the service user on your desktop X session first (run as YOUR user):
 xhost +SI:localuser:ci-runner
-
-# then open the VMX as ci-runner, forcing the display:
+```
+Then open the GUI as ci-runner, forcing the display:
+```bash
 ci vmgui --vmx /var/lib/ci/build-vms/Clone_dbg-1_*/Clone_dbg-1_*.vmx --display :0
 ci vmgui --vmx <path> --display :0 --power-on      # also power it on (-x)
 ci vmgui --vmx <path> --display :0 --fullscreen    # power on + fullscreen (-X)
-
-# bare GUI, no VM loaded (just open Workstation):
-ci vmgui --display :0
+ci vmgui --display :0                              # bare GUI, no VM loaded
 ```
-The GUI needs an X display; `sudo -u ci-runner` strips `$DISPLAY`, so pass
-`--display :0` (or export `DISPLAY`). Other flags: `--new-window` (`-n`),
-`--vmware-path` to override the binary. The command spawns the GUI detached and
-returns immediately (prints the child PID).
+**If nothing opens**: you skipped the `xhost` step. `vmgui` now pre-flights the
+display (`xdpyinfo`) and fails with the exact `xhost` command instead of dying
+silently; it also drops an unreadable inherited `XAUTHORITY` and logs the GUI's
+output to `/tmp/vmgui-*.log`. The GUI needs an X display — `sudo -u ci-runner`
+loses your cookie, so `xhost` + `--display :0` is the reliable combo. Other
+flags: `--new-window` (`-n`), `--vmware-path`. Spawns detached, prints PID + log.
 
 ---