tap action: run an automation, a script or a scene — with a confirm guard

Owner's spec (2026-07-29), agreed points: one 'Run' action covering the
three runnable domains of HA (a script is the idiomatic 'action' — with
automations alone people would build trigger-less dummies); the confirm
checkbox guards BOTH toggle and run; covers and valves join the card-wide
toggle so curtains work natively.

- marker.tap_action gains 'run'; marker.tap_target (schema-bounded to
  automation./script./scene. ids); marker.tap_confirm.
- the dialog: a searchable picker over the three domains (friendly name +
  kind), save refuses a run action without a target, a vanished target gets
  a warning hint; the checkbox shows for any actionable tap (explicit or
  effective-default toggle).
- the tap: automation.trigger / script.turn_on / scene.turn_on, started/
  error toasts; with confirm on — our own dialog (not window.confirm, it
  must work on a wall tablet), Esc/backdrop/Cancel = no call. The guard
  covers the controls-toggle path too.
- 'run' is explicit-only by construction: it needs a per-marker target, so
  it can never arrive as a card-wide default.
- covers: the old test pinned 'garage stays shut' — that intent survives as
  COVER_GUARDED_CLASSES (garage/door/gate stay out of the CARD-WIDE toggle;
  an explicit per-device toggle remains the owner's conscious choice).
  Locks/alarms stay forbidden everywhere, run included is not affected —
  we do not inspect automation contents, same trust as HA's own Run button.

Tests: unit resolveTapAction/runServiceFor + cover guard, backend schema
parity picks 'run' automatically + tap_target bounds, smoke_tap_run with 11
assertions (picker, search, save guard, confirm cancel/ok, per-domain
services, missing target). smoke_tap_ctx: 4 options now.
Inventory: 148 / 52 / 43 / 72.

tests_backend/test_validation.py

@@ -390,6 +390,16 @@ def test_every_display_mode_the_editor_offers_is_accepted():
         v.MARKER_SCHEMA(_marker(display="wat"))
 
 
+def test_run_target_is_bounded_to_runnable_domains():
+    """Owner's spec 2026-07-29: a tap may RUN automations, scripts and scenes —
+    and nothing else. The target rides the marker, so the schema is the door."""
+    for ok in ("automation.morning", "script.curtains", "scene.movie"):
+        v.MARKER_SCHEMA(_marker(tap_action="run", tap_target=ok, tap_confirm=True))
+    for bad in ("light.lamp", "lock.front_door", "shell_command.rm", "automation.", "x"):
+        with pytest.raises(vol.Invalid):
+            v.MARKER_SCHEMA(_marker(tap_action="run", tap_target=bad))
+
+
 def test_every_tap_action_the_editor_offers_is_accepted():
     for action in _ts_list("TAP_ACTIONS"):
         v.MARKER_SCHEMA(_marker(tap_action=action))