feat(plot)!: harden pipeline, XY series, dash/markers, touch, packaging

Breaking: Series::gather emits x relative to x0() and takes a GatherMode;
consumers reconstruct absolute x in f64 before mapping (series.hpp documents
the contract).

Bugs, each pinned by a fail-before regression test:
- render: f32 staging quantised epoch-time x into 128 px columns; every
  data-space draw now stages to_space(x) - to_space(origin) with the origin
  folded into the offset uniform in f64 (epoch/zero-origin twins rasterise
  identically)
- ticks: major test was ULP-fragile and blanked epoch axes; majors are an
  integer-index test and are never truncated by the minor cap
- gather: LOD envelope emitted buckets straddling [begin,end); ceil/floor
  bucket edges + raw lead/trail spans
- live follow: log x axes held a linear span and zoomed every frame; span and
  offset now live in axis space (plot + both figure link-group paths)
- input: a zero-notch wheel disarmed auto_scale on every axis; dy==0 pans x,
  factor == 1 / inf refused in wheel and drag zoom
- render: the single text flush painted legend names over the crosshair
  readout panel; two batches, under flushed before the panel
- data: NaN dropped from min/max unless it seeded the fold; non-finite
  samples are now excluded from every aggregate and from cached bounds

Robustness: viewport normalisation (no clamp UB), non-finite range refusal,
pyramid level cap at 57 (no shift/div UB through public gather), rounded ring
capacity documented + pre-sized, GL blend func and UNPACK_ALIGNMENT
save/restore, Renderer::release_gl() teardown, u64 buffer epochs, annotation
captions clamped, button-aware GLFW row capture, cached figure row rects (no
per-event layout), ruler-pair measurement refused, span-nonfinite guards in
axis_ends.

Features: XY series (sorted x, binary-search neighbours/snap, LOD over sample
index); StreamSeries::freeze(); ArraySeries::push(); per-trace dash and
markers (scatter at width 0) with auto or literal stride; GatherMode
Envelope/Nearest/Mean via bucket_sum/sumsq; Style::line_aa_px; per-glyph text
colour (readout values in trace colour); wheel-dx x pan; arrow-key pan;
Escape cancels a drag and restores captured ranges; modifier-masked box zoom
(Shift both, Ctrl x, Alt y); double-click reset via PointerEvent::time_s;
ImGui key repeat unified; pinch gestures on Qt and GTK; pixelDelta wheel path
and DevicePixelRatioChange handling; GNUInstallDirs, SOVERSION,
SameMinorVersion, generated plot/version.hpp, relocatable plot.pc, licence
install, FILES_MATCHING, GitHub Actions CI (debug/coverage/asan).

Suite 283 -> 350 cases, 0 failed; coverage 93.9% (3730/3971) over 24 files,
floor 80/90 held; ASAN preset suite green; all four demos run headless (the
GTK scripted-resize check needs a window manager and fails identically on the
parent commit); readme_main.cpp committed and compiles with the README
command; pkg-config and find_package consumption verified from a relocated
install prefix.

adapters/glfw/glfw_host.hpp

@@ -128,9 +128,10 @@ class Host {
   input::Controller* row_controller(u32 row) noexcept;
   /// The controller an event at framebuffer pixel (x, y) belongs to: `controller_` --
   /// the single-plot loop -- while no figure is set, and the controller of the figure
-  /// row that pixel lands in otherwise. The row rects come from `Figure::layout()`, the
-  /// same ones the renderer draws, so a gesture lands on the row it was aimed at; a
-  /// pixel inside no row -- the row gap a host asked for with `Figure::set_row_gap()`,
+  /// row that pixel lands in otherwise. The row rects come from the cache
+  /// `refresh_row_rects()` fills -- the same ones the renderer draws -- so a gesture
+  /// lands on the row it was aimed at and no event lays the figure out; a pixel
+  /// inside no row -- the row gap a host asked for with `Figure::set_row_gap()`,
   /// or a margin -- is the *nearest* row rather than dropped or defaulted, so a drag
   /// that leaves the data area still ends where it should.
   ///
@@ -147,13 +148,38 @@ class Host {
   ///
   /// The routing is the row the event lands in, with one exception that is the whole
   /// point of it: a press **captures** the row it landed in, and every motion and the
-  /// release until that button comes up go to the captured row. A drag that crosses
+  /// release until *that button* comes up go to the captured row. A drag that crosses
   /// into a neighbouring figure row is therefore still the drag it began as -- the
   /// owning controller sees the motion and the release that end it -- rather than
   /// being handed to a controller whose `mode_ == None`, which would leave the owner's
   /// drag open for ever and let a later gesture resume it from the old anchor.
+  ///
+  /// Single-gesture policy: a figure routes one button-down gesture at a time. The
+  /// first button to press claims the capture; a second button pressed meanwhile --
+  /// a chord, or a trackpad that reports a second finger as a button -- neither
+  /// steals the capture to another row nor ends it, and only the owning button's
+  /// release ends it. Whatever the second button's events do to the controllers is
+  /// the controllers' business; the host only guarantees they all arrive at the row
+  /// the first press claimed.
   void feed_pointer_event(const input::PointerEvent& e) noexcept;
 
+  /// Re-reads the figure's row rects into the cache every event handler below
+  /// reads -- the one `Figure::layout()` the routing costs between two frames. The
+  /// run loop calls this once per frame, right after the figure's viewport is set,
+  /// so the rects the handlers answer from are the rects that frame draws; the
+  /// handlers themselves never lay the figure out.
+  ///
+  /// A driver that injects events without running the loop -- a scripted run, the
+  /// headless tests -- calls this after re-configuring the figure (a new viewport,
+  /// a new row gap, `set_figure()`): it is the scripted equivalent of the frame the
+  /// run loop would have staged. Until it runs, the handlers answer from the last
+  /// refreshed rects, which is also what happens across a window resize: GLFW
+  /// delivers the resize and any pointer events queued behind it in one batch, the
+  /// events before the resize see the rows the previous frame drew, and the loop's
+  /// next `refresh_row_rects()` brings the cache onto the new geometry -- rows are
+  /// at most one frame stale, never wrong by a second layout.
+  void refresh_row_rects() noexcept;
+
   /// The gesture controller the host feeds. Valid for the host's whole life.
   input::Controller& controller() noexcept { return controller_; }
 
@@ -198,11 +224,12 @@ class Host {
   static u32 row_in(const std::vector<Rect>& rows, f32 y) noexcept;
 
   /// The controller a pointer event at (x, y) belongs to, applying the button capture:
-  /// a press claims the row it landed in (`captured_row_`) and every motion and the
-  /// release until the button comes up are routed to it; `controller_at()` is the pure
-  /// query that never captures. Also hands the target its row's viewport, so the
-  /// hit-test geometry is the last frame's.
-  input::Controller& pointer_target(f32 x, f32 y, bool pressed, bool released) noexcept;
+  /// a press claims the row it landed in (`captured_row_` + `captured_button_`) and
+  /// every motion and the release until *that button* comes up are routed to it;
+  /// `controller_at()` is the pure query that never captures. Also hands the target
+  /// its row's viewport, so the hit-test geometry is the last frame's.
+  input::Controller& pointer_target(f32 x, f32 y, input::Button button, bool pressed,
+                                    bool released) noexcept;
 
   /// The row the pointer's events currently go to: the captured row while a drag owns
   /// the button, the row under the pointer otherwise. The run loop uses it to clear
@@ -254,11 +281,23 @@ class Host {
   f64 spread_y_ = 0.0;
   bool spread_active_ = false;
 
-  /// The row a button-down drag has captured: the row its press landed in, which
-  /// owns its motions and its release until the button comes up. `captured_` is
-  /// false between gestures, and cleared when another figure is set.
+  /// The row a button-down drag has captured, and the button that owns the capture:
+  /// the row its press landed in owns that button's motions and its release until
+  /// the button comes up. `captured_` is false between gestures, and cleared when
+  /// another figure is set. The button is recorded because only the owning button's
+  /// release ends the capture (R5): a second button pressed while the drag runs is
+  /// routed to the same row and must neither steal the capture nor end it, or its
+  /// release would strand the first button's drag.
   bool captured_ = false;
   u32 captured_row_ = 0u;
+  input::Button captured_button_ = input::Button::Left;
+
+  /// The figure's row rects as of the last `refresh_row_rects()` -- the cache the
+  /// event routing reads instead of laying the figure out per event (R7). Filled by
+  /// `set_figure()` and once per frame by the run loop; empty while no figure is
+  /// set, which is the state `controller_at()`/`pointer_target()` fall back to the
+  /// single-plot controller on.
+  std::vector<Rect> row_rects_;
 
   u32 fb_width_ = 0;   ///< framebuffer size of the last refresh_sizes()
   u32 fb_height_ = 0;