wayland/screencopy: bind transform query wl_output with a private listener

[pcmid]

What was wrong

WlrScreencopyContext::OutputTransformQuery binds a second wl_output for the captured screen to learn its transform, and did so through Qt's generated QtWayland::wl_output, i.e. with Qt's own m_wl_output_listener on the proxy. Compositors send wl_surface.enter for every wl_output resource a client holds (smithay and wlroots both do), and QWaylandScreen::fromWlOutput() decides whether an output is one of its screens purely by comparing that listener. So it accepted our proxy, static_cast the OutputTransformQuery to a QWaylandScreen and appended the result to QWaylandSurface::m_screens. A release()d proxy never receives leave, so the entry outlived the context and was dereferenced on the next screensChanged — QPlatformScreen::screen() on freed memory, whole shell down.

The fix

Keep the extra bind, but do it by hand (wl_registry_bind + a private wl_output_listener), so fromObject() rejects the proxy and surface_enter() ignores it. No behaviour change otherwise: transform is still read from wl_output.geometry, updateTransform() / submitFrame() are untouched.

Reading QWaylandScreen::mTransform through the existing reflector instead (no second bind at all) was tried first and does not work: Qt resets it to -1 in updateOutputProperties(), and QScreen::orientation() drops the flipped transforms. That variant produced an unrotated capture on a transform 90 output.

Verification (niri 26.04, Qt 6.11.2)

• Deterministic reproducer from Screencopy: second wl_output bind poisons QWaylandSurface::m_screens (UAF crash, root cause of #876) #1094: crashed on the first hide 3/3 before, runs to completion 3/3 after. WAYLAND_DEBUG still shows the second bind and the duplicate enter — now harmless.
• Capture on a normal output: matches dms screenshot of the same moment (RMSE 0.013 at 480px).
• Capture on the same output rotated to transform 90: 2160×3840, upright, matches the reference (the mTransform variant did not).
• Builds clean on master and on v0.3.1; clang-format clean.

Disclosure

To be upfront: I am not really familiar with Qt or C++, and this code was written entirely by an AI assistant working with me — the analysis in #1094, the reproducer, the patch and the verification all came out of that session. If anything here is wrong, unidiomatic, or simply not how you would want it done, please say so; I am happy to rework it however you prefer. What I can vouch for is that it fixes the crash on my machine.

I am aware this is not a great fix. It keeps the original "cursed hack" intact — a second wl_output bind per capture, and a reflector subclass poking at QWaylandScreen's protected m_outputId to know which global to bind — and only changes whose listener the proxy carries. It removes the crash without removing the reason the hack exists: QtWayland does not expose the raw output transform anywhere (mTransform is transient, QScreen::orientation() drops flips). If there is a better way to get at the transform without a second bind or private Qt state, I would much rather do that — please say so and I will rework it.

Fix #1094