fix(render): one fence per frame for the vertex ring; two qt6 adapter fixes

The persistent-mapped instance ring had three slots and recorded a fence per
upload, so a frame recycled a slot whose fence was recorded a few draws earlier
*in that same frame*: from the fourth of the demos' nine uploads on, each one
waited on the frame's own work. It is free on a driver that retires draws
promptly (the GLFW host, 1.07 ms/frame) and ~4 ms of the Qt widget's 7.11 ms
under llvmpipe, and it grows with the trace and cursor counts this library
exists for.

* The ring grows to cover a frame's upload count, the frame's write cursor is
  the ring index (so a frame writes 0, 1, 2, ... and never a slot twice), one
  fence is recorded after the frame's last draw, and the only wait is at the
  start of the next frame. A wait that times out, or a slot written with no
  fence ever recorded behind it, drops the store to the orphan path -- the
  treatment a refused fence already had -- so nothing is ever written into
  storage the GPU may still be reading.
* New test-only counters (PLOT_RING_STATS, the PLOT_PYRAMID_COUNT_* pattern:
  free functions, no member, so no consumer's layout changes) pin a frame's
  upload and wait counts. The new tests assert the frame's slot offsets are
  distinct, that the ring grew past its floor to cover the frame, and that a
  frame waits at most once per store -- read from the counters and from
  glClientWaitSync itself.
* qt6: print the unresolved entry-point names before the load-failure branch,
  which used to return first and leave the one failure this widget can have
  reporting nothing but a generic message.
* qt6: the cached pointer anchor is now in logical pixels and a move's delta is
  the logical difference scaled by the DPR in effect, so a scale change between
  two move events (the window dragged onto another monitor mid-drag) is no
  longer a cross-scale jump applied as a pan. The anchor moved into a
  toolkit-free unit (adapters/qt6/qt_pointer.hpp) with its own test.

GLFW demo headless: 1.07 -> 0.73 ms/frame. Qt widget under xvfb/llvmpipe:
7.1 -> 3.8 ms at dpr 1.0, 6.7 -> 3.6 ms at 1.25, with both upload paths still
rendering and the demo's scripted pan/box-zoom checks passing at both scales.

src/render/renderer.cpp

@@ -163,6 +163,16 @@ void Renderer::begin_frame(u32 fb_w, u32 fb_h, Rect viewport_px) noexcept {
     return;
   }
 
+  // One wait per store, before any slot of this frame is written: the ring never
+  // synchronises with the work its own frame issued, only with the frame before
+  // it. A store that cannot retire that frame has dropped to the baseline path,
+  // which the frame reports.
+  const bool lines_retired = line_vao_.begin_frame();
+  const bool glyphs_retired = text_vao_.begin_frame();
+  if (!lines_retired || !glyphs_retired) {
+    gl_error_ = true;
+  }
+
   const gl::GLint vx = static_cast<gl::GLint>(gl_viewport_.x);
   const gl::GLint vy = static_cast<gl::GLint>(gl_viewport_.y);
   const gl::GLsizei vw = static_cast<gl::GLsizei>(gl_viewport_.w);
@@ -225,6 +235,15 @@ void Renderer::end_frame() noexcept {
   if (!ready_) {
     return;
   }
+  // The frame's single fence per store, behind every draw that read the ring: the
+  // next frame's begin_frame() waits for it, and until then nothing is written to
+  // a slot these draws may still be reading. Recording it here -- after the last
+  // draw, not after each upload -- is what keeps a frame from waiting on itself.
+  const bool lines_guarded = line_vao_.mark_drawn();
+  const bool glyphs_guarded = text_vao_.mark_drawn();
+  if (!lines_guarded || !glyphs_guarded) {
+    gl_error_ = true;
+  }
   // Leave the host's context as close to neutral as a frame can: nothing bound to
   // a pipeline stage, and off every state bit the frame turned on. What remains
   // is the viewport (the caller's to set for its next pass), the pixel-pack
@@ -270,13 +289,6 @@ void Renderer::flush_lines(const Mapping& map, Color color, f32 width) noexcept
     // One triangle strip per instance, four corners from gl_VertexID.
     gl::glDrawArraysInstanced(gl::GL_TRIANGLE_STRIP, 0, 4,
                               static_cast<gl::GLsizei>(line_vao_.instance_count()));
-    // The draw is in the command stream now, so this is the point at which the
-    // mapped path can let a fence follow it. A driver that refused the fence has
-    // already dropped this store to the baseline path; the frame reports it here
-    // rather than rotating through a slot nothing guards.
-    if (!line_vao_.mark_drawn()) {
-      gl_error_ = true;
-    }
     stats_.staged_segments += segments;
     ++stats_.draw_calls;
   }
@@ -299,9 +311,6 @@ void Renderer::flush_text() noexcept {
     text_vao_.bind();
     gl::glDrawArraysInstanced(gl::GL_TRIANGLE_STRIP, 0, 4,
                               static_cast<gl::GLsizei>(text_vao_.instance_count()));
-    if (!text_vao_.mark_drawn()) {
-      gl_error_ = true;
-    }
     ++stats_.draw_calls;
   }
   glyphs_.clear();