[SimonCropp]

PlatformHeads 0.13.0 (PlatformHeads#14) lets TerminateGuard take a sessionEnding. At a logout, restart or shutdown it runs that from inside the pump and lets the quit through.

Until now both macOS heads refused every quit that came from outside the managed loop. A refused quit cancels the logout that asked for it, so with the tray or a viewer running, the person had to log out again once it had gone, and an unattended restart didn't happen.

Pins. All seven move to 0.13.0 together, and claude.md says so.

Viewer. No ABI change.

• The managed side already hands deview_on_display_lost its session end on every native window. That runs ViewerProgram.SessionEnding, which stages the queue the viewer owns, and then saves the placement.
• On macOS that export used to do nothing. Now Runtime keeps the callback and gives it to TerminateGuard as sessionEnding.
• A Dock quit is still reported as a close, as before.
• No DEVIEW_VERSION bump. Either side paired with the other side at a different age behaves as it did before, so nothing can be misread. deview.h records this.
• Nothing presents before the hook is set. It's set right after deview_init, so no event that could be a logout is dispatched without it.

Tray. DETRAY_VERSION goes to 2.

• A new export, detray_on_session_end, takes the callback.
• MacTray.Open sets it before detray_init, because Tray.start now makes the guard from whatever was set by then. A library with no callback refuses a session's end as before, which cancels the logout but loses nothing.
• The callback is an [UnmanagedCallersOnly] function pointer, as the viewer's is. That's why DiffEngineTray.Core now allows unsafe code.
• The Mac head's Program builds TraySessionEnd.For(owned, TrayVersionFile.Delete) once. It hands it to both MacTray.SessionEnding and SessionEndSignals, so the queue is staged and the version marker removed whichever way the session ends.
• detray_quitting now reports only quits other than a session's end, such as AppleScript's quit.
• detray.h's pointer to the managed half now names src/DiffEngineTray.Core/Detray.cs, where it moved to.

Binaries. The Swift changed, so build-native should propose rebuilt macOS libraries into this branch. Until those land, the native job will report the tray library as version 1 where version 2 is expected. That's the version check doing its job.

Tests. Locally on Windows, the Release build had no errors. Of 3,845 tests in the whole solution, 3,792 passed, 49 were skipped and 4 failed. The four are the ListenerTable tests that always fail on this machine's Windows build (10.0.26300), two each on net48 and net10.0, and they don't touch anything this PR changes.

Nothing here could be compiled or run on macOS locally. CI's unix job builds both libraries from source, and MacTrayTests checks the tray library reports version 2.

Nothing has been tried with a real logout. PlatformHeads' TerminateGuardTests cover the guard's answer to each kind of quit. What CI can't do is log a Mac out. Worth trying by hand on a Mac before a release: log out with the tray holding an inline snapshot, and check that the logout goes through and the trio is staged in obj/VerifyInline.