fix(context-menu): re-snapshot lazily populated system submenus (items missing in "Send to" / "New")

[v4806]

Symptom

System submenus that Shell takes from the original menu can lose items and vary between openings,
while the native menu is always complete. Most visible in Send to: only 3-5 of the 9 items appear,
and a different subset each time. The same symptom has been reported for the New submenu and for
certain file types.

Affects both Windows 10 and Windows 11 - see #749 (also reported there on Win 11 25H2) and #815
(also reported there on Win 11 23H2), plus #464 and #614.

Root cause

build_system_menuitems() snapshots the original menu during Initialize(), i.e. in the
IContextMenu::QueryContextMenu phase. But shell32 fills these submenus lazily: at that moment
only a few items exist, so the snapshot is incomplete. When the submenu actually pops up, explorer's
original handle already contains the full set, yet OnInitMenuPopup() only replays the stale
snapshot.

Fix

• menuitem_t gains HMENU source_handle - the original submenu handle, recorded while snapshotting.
• menu_t gains menuitem_t *std_owner - points back to its snapshot item.
• In OnInitMenuPopup(), if GetMenuItemCount(source_handle) exceeds the snapshot count, the snapshot
  is cleared and rebuilt from the original handle; the main menu refreshes the whole tree once as a
  safety net.

Rebuilding through Shell's own build_system_menuitems() is required: copying the items out of
explorer's HMENU with InsertMenuItemW cannot work, because they are owner-draw items whose
dwItemData points at explorer-internal data.

The change is purely additive plus one conditional call - when source_count <= snapshot_count the
behaviour is exactly as before.

Verification

Windows 10 22H2 + Shell 1.9.19, desktop shortcut -> More options -> Send to:

	Items
Before	3
After	9 (stable over 4 consecutive rounds, including an explorer restart)

I could not test Windows 11 myself, but the mechanism is version-independent (the snapshot is taken
before shell32 populates the submenu) and the same symptom is reported there in #749/#815.

[FIX] refetch '发送到(&N)' snapshot=3 now=9

[v4806]

Also reported as #749, #464, #614, #815 — all four look like the same root cause: shell32 fills the "Send To" submenu lazily, but Shell takes its snapshot of the original menu much earlier (during QueryContextMenu). By the time the submenu is actually popped up the original handle is complete, yet OnInitMenuPopup() replays the stale snapshot forever. This PR re-snapshots at popup time, so it should fix all of them.

同一根因的其它报告：#749、#464、#614、#815 —— shell32 是惰性填充「发送到」子菜单的，而 Shell 抓快照的时机远早于此（QueryContextMenu 阶段）。子菜单真正弹出时原始句柄已经完整，但 OnInitMenuPopup() 只会重放旧快照。本 PR 在弹出时重抓快照，应当一并修复这几个问题。