[albertwoo]

wasm: harden the GPU surface and renderer

Follow-up to #16, applying its review findings. Stacked on investigate/wasm-gpu so the diff here is only the fixes.

Texture-path bugs (browser-only, would corrupt or crash on real pages)

• updateTexture over-read the atlas (main.js): the view was built as stride * h, but CUI hands the callback a pointer to the first pixel of the damaged rect (cui_text.c:880 passes atlas + y0 * atlas_w + x0), so the span ends at the last pixel of the last row: (h - 1) * stride + w * fmt. The old math read up to x * fmt bytes past the end of the atlas for any rect not flush left — and threw RangeError outright when the source ended near the top of the wasm heap. Same formula CUI's own runtime.js uses.
• createTexture uploaded wasm address 0 when CUI creates an empty texture with a null pixel pointer (a fresh emoji atlas does exactly that, cui_emoji.c:714), which would have uploaded the heap's first bytes as pixels. Null now stays null, as in runtime.js:83.

Pixel-size agreement at fractional display scales

• CuiSurface.PixelWidth/PixelHeight truncated while CUI rounds width_px = vw * scale + 0.5f (cui_core.c:849); the JS resize() truncated too. At devicePixelRatio 1.5 with an odd CSS width the canvas and the frame disagreed by a pixel, and GLRenderer.draw threw every frame. C# and JS now round the way CUI does, and GLRenderer.draw follows the draw data for the backing store instead of refusing the frame (same behavior as CUI's preview.js:192).

Surface contract

• GetDrawData now throws ObjectDisposedException: cui_get_draw_data returns &ui->draw_data, so a destroyed context yields a plausible pointer into freed memory, not null.
• Restored BeginFrame's <summary>, which CreateGpu had clobbered when inserted before it.
• Incremental now rejects a GPU surface even when assigning the value it already has.
• CreateGpu names the offending parameter in its ArgumentException.

Test/CI gaps closed

• New GpuSurfaceTests (7 tests, desktop CI): font-atlas upload on first text, in-place texture_update when new glyphs appear, draw-data disposal guard, software-only member guards, missing-callback rejection, software surface Kind, and the 1.5-scale pixel rounding.
• The scratch-canvas webgl2 probe in main.js is gone — it spent the one attempt the retry loop existed to repeat, so under --disable-gpu a slow GPU-process start silently chose software forever. The retry now asks the real canvas.
• test-browser-smoke.py takes --renderer webgl2|2d and asserts the renderer the page reports, so a silent software fallback can no longer pass as the GPU path. The Pages workflow smoke-tests both renderers, gains a pull_request trigger (browser regressions caught before merge), and keeps the deploy jobs gated to main.
• GLRenderer deletes its shader objects after linking (as cui_render_gl.c does), takes keepDrawingBuffer explicitly, and the smoke-state machine drops a dead assignment.

Verification

• 697 + 28 tests, build with warnings-as-errors, dotnet format --verify-no-changes, and regen -NoNative -NoDiff all green.
• test-browser-smoke.py --renderer webgl2 and --renderer 2d both pass with the new renderer assertion active.
• Live headless Chrome: clicking the name field, selecting all, and typing glyphs missing from the atlas (∑∫€§Ω≈√∀∃) produced two texSubImage2D calls through the corrected span with no exception, and the rendered field updated.