feat(plot)!: harden pipeline, XY series, dash/markers, touch, packaging

Breaking: Series::gather emits x relative to x0() and takes a GatherMode;
consumers reconstruct absolute x in f64 before mapping (series.hpp documents
the contract).

Bugs, each pinned by a fail-before regression test:
- render: f32 staging quantised epoch-time x into 128 px columns; every
  data-space draw now stages to_space(x) - to_space(origin) with the origin
  folded into the offset uniform in f64 (epoch/zero-origin twins rasterise
  identically)
- ticks: major test was ULP-fragile and blanked epoch axes; majors are an
  integer-index test and are never truncated by the minor cap
- gather: LOD envelope emitted buckets straddling [begin,end); ceil/floor
  bucket edges + raw lead/trail spans
- live follow: log x axes held a linear span and zoomed every frame; span and
  offset now live in axis space (plot + both figure link-group paths)
- input: a zero-notch wheel disarmed auto_scale on every axis; dy==0 pans x,
  factor == 1 / inf refused in wheel and drag zoom
- render: the single text flush painted legend names over the crosshair
  readout panel; two batches, under flushed before the panel
- data: NaN dropped from min/max unless it seeded the fold; non-finite
  samples are now excluded from every aggregate and from cached bounds

Robustness: viewport normalisation (no clamp UB), non-finite range refusal,
pyramid level cap at 57 (no shift/div UB through public gather), rounded ring
capacity documented + pre-sized, GL blend func and UNPACK_ALIGNMENT
save/restore, Renderer::release_gl() teardown, u64 buffer epochs, annotation
captions clamped, button-aware GLFW row capture, cached figure row rects (no
per-event layout), ruler-pair measurement refused, span-nonfinite guards in
axis_ends.

Features: XY series (sorted x, binary-search neighbours/snap, LOD over sample
index); StreamSeries::freeze(); ArraySeries::push(); per-trace dash and
markers (scatter at width 0) with auto or literal stride; GatherMode
Envelope/Nearest/Mean via bucket_sum/sumsq; Style::line_aa_px; per-glyph text
colour (readout values in trace colour); wheel-dx x pan; arrow-key pan;
Escape cancels a drag and restores captured ranges; modifier-masked box zoom
(Shift both, Ctrl x, Alt y); double-click reset via PointerEvent::time_s;
ImGui key repeat unified; pinch gestures on Qt and GTK; pixelDelta wheel path
and DevicePixelRatioChange handling; GNUInstallDirs, SOVERSION,
SameMinorVersion, generated plot/version.hpp, relocatable plot.pc, licence
install, FILES_MATCHING, GitHub Actions CI (debug/coverage/asan).

Suite 283 -> 350 cases, 0 failed; coverage 93.9% (3730/3971) over 24 files,
floor 80/90 held; ASAN preset suite green; all four demos run headless (the
GTK scripted-resize check needs a window manager and fails identically on the
parent commit); readme_main.cpp committed and compiles with the README
command; pkg-config and find_package consumption verified from a relocated
install prefix.

include/plot/data/minmax_pyramid.hpp

@@ -19,6 +19,12 @@ struct MinMax {
 /// series and the level maths is a shift.
 inline constexpr u32 kBucket = 64;
 
+/// Deepest pyramid level. `kBucket << 57` is `2^63`, the widest bucket span a
+/// u64 sample count can name; past it the shift would overflow (UB), so every
+/// level computation clamps here and a `gather()` asked for a deeper level
+/// simply gets this one (whose buckets are already wider than any window).
+inline constexpr u32 kMaxPyramidLevel = 57;
+
 /// Incremental min/max LOD pyramid, indexed in absolute bucket space.
 ///
 /// Level `l` bucket `k` covers the absolute samples
@@ -37,14 +43,14 @@ inline constexpr u32 kBucket = 64;
 /// `drop_before(u)` slides the window's leading edge to absolute sample `u`: each
 /// level discards the buckets whose span starts before `u`, so the memory is
 /// bounded by the retained window and not by the number of samples ever appended.
-/// A bucket entry is 24 bytes -- `MinMax` plus the exact `sum`/`sumsq` the exact
-/// range queries fold over -- so level 0 costs 0.375n bytes and the geometric tail
-/// brings the whole pyramid to about 0.75n bytes, ~19% of the 4n bytes of raw
-/// samples. (A min/max-only index would be 0.25n, ~6%: the two doubles are the
-/// price of answering mean/RMS/integral from whole buckets instead of raw
-/// samples.) Every stored entry is the complete aggregate of its own span and
-/// every stored span lies inside the retained window, so no aggregate is ever
-/// recomputed or invalidated.
+/// A bucket entry is 32 bytes -- `MinMax` plus the exact `sum`/`sumsq` the exact
+/// range queries fold over and the finite-sample `count` the mean folds by -- so
+/// level 0 costs 0.5n bytes and the geometric tail brings the whole pyramid to
+/// about 1n bytes, ~25% of the 4n bytes of raw samples. (A min/max-only index
+/// would be 0.25n, ~6%: the extra words are the price of answering mean/RMS/
+/// integral from whole buckets instead of raw samples.) Every stored entry is
+/// the complete aggregate of its own span and every stored span lies inside the
+/// retained window, so no aggregate is ever recomputed or invalidated.
 ///
 /// Queries are in *window* coordinates: index 0 is the oldest retained sample,
 /// `size()` is the retained sample count, and `window_base()` is the absolute
@@ -64,6 +70,11 @@ class MinMaxPyramid {
   /// appends never grows the level vector. The bucket deques themselves grow in
   /// chunks: a sliding window cannot know their final length up front.
   void reserve(u64 n);
+  /// Folds one sample into the pyramid. A non-finite sample advances the
+  /// absolute sample count (bucket boundaries are positional) but is excluded
+  /// from the aggregates: min/max/sum/sumsq/count never see it, and a bucket
+  /// whose samples were all non-finite is stored as an empty aggregate
+  /// (count 0, zero sums) that every reader treats as absent.
   void append(f32 v);
   /// Slides the retained window's leading edge to absolute sample index
   /// `absolute_sample`, dropping every aggregate that covered a sample before it.
@@ -100,6 +111,15 @@ class MinMaxPyramid {
   /// Aggregate of the absolute level-`l` bucket `i`. Precondition:
   /// level_base(l) <= i < level_base(l) + level_size(l).
   MinMax bucket(u32 l, u64 i) const;
+  /// The bucket's exact `sum`/`sumsq` folds -- what `GatherMode::Mean` needs to
+  /// average a bucket and what an RMS readout folds without touching raw
+  /// samples. Same precondition as `bucket()`.
+  f64 bucket_sum(u32 l, u64 i) const;
+  f64 bucket_sumsq(u32 l, u64 i) const;
+  /// How many *finite* samples the bucket aggregated: the divisor that makes
+  /// `bucket_sum()` a mean under the non-finite-exclusion policy, and 0 exactly
+  /// when the bucket holds no usable sample. Same precondition as `bucket()`.
+  u32 bucket_count(u32 l, u64 i) const;
 
   /// Min/max over the whole level-0 buckets fully contained in the window range
   /// [begin, end). Partial edge buckets are excluded, never approximated; an
@@ -119,13 +139,18 @@ class MinMaxPyramid {
   u64 snap(f64 x, f64 x0, f64 dx) const;
 
  private:
-  /// One bucket: its extremes plus its own exact sum and sum of squares. The two
-  /// doubles take a bucket from 8 bytes to 24, which is what lets mean/RMS/
-  /// integral come from whole buckets instead of raw samples.
+  /// One bucket: its extremes plus its own exact sum and sum of squares, and
+  /// how many finite samples produced them. The extra words take a bucket from
+  /// 8 bytes to 32, which is what lets mean/RMS/integral come from whole
+  /// buckets instead of raw samples -- and the count is what keeps a bucket of
+  /// nothing (all its samples non-finite) empty rather than zero-valued: an
+  /// entry with count 0 has zero sums and a meaningless mm, and every reader
+  /// skips it.
   struct Entry {
     MinMax mm;
     f64 sum = 0.0;
     f64 sumsq = 0.0;
+    u32 count = 0;   ///< finite samples folded in; 0 = an empty bucket
   };
   /// One level's complete buckets, in absolute bucket-index order.
   struct Level {