fix(plot,render,gl): live streaming measurements, handed-back GL state

Final whole-branch review fixes.

1 (Important). Plot::measurement() cached on (series pointer, sample count)
only, so a saturated StreamSeries -- whose size() stays pinned while x0()
advances every acquire() -- froze its readout on the first saturated frame
until a cursor moved. The cache key now carries the series' x0() (new
MeasureSlot::last_x0), so a sliding window recomputes and a static series
still does not: asserted with a new macro-gated counter hook
(plot/detail/measure_count.hpp, PLOT_COUNT_MEASURE_RECOMPUTES, wired like the
pyramid and ring counters, absent from the release library). New case
saturated_stream_measurement_tracks_the_sliding_window: saturated ring,
stationary cursors, ramp in absolute x -- zero recomputes for repeated reads
with nothing moving, one per acquire while it slides.

2-3, 9. Spec: 4.3 described a GL_LINE_STRIP path that does not exist (there is
one rasteriser -- instanced anti-aliased quads -- and dense_threshold_spp
selects the gather level, not a primitive); 8 named a PLOT_GL_CHECK() macro
that exists nowhere, and stated no exception policy. The table, the field's
comment and 8 now describe the real gather-level threshold, the real
glGetError() drain plus the stores' drop-to-orphan fallbacks, and the real
policy: library failures return Status/bool, allocating entry points propagate
std::bad_alloc.

4. The frame handed back neither GL_UNPACK_ALIGNMENT (init() sets 1 for the
atlas) nor the clear colour (queried once with a new glGetFloatv entry).
end_frame() restores both and renderer.hpp lists them in the residue
contract.

5. draw() kept a host TextBackend for layout while drawing with its own font.
The renderer now installs its font unconditionally -- strips and labels measure
and draw with one backend -- with a debug-build diagnostic if a different one
was set, and Plot::set_text_backend() is documented as the no-renderer path.
New case renderer_measures_the_labels_it_draws asserts layout, measuring and
the drawn label's ink agree.

6-10. draw()'s style overwrite stated at the call site; the load-sensitive
wall-clock bound in test_measure.cpp replaced by a counter assertion (same
interval, same fold count over a 512x length ratio); dump_frame_ppm drops
noexcept and says why it may allocate; error.txt ignored (not this project's,
not generated here) rather than deleted.

Verified: debug and release build clean (-Wall -Wextra -Wpedantic -Wconversion
-Wshadow), 4/4 ctest entries pass, 130 cases pass (was 127), umbrella and
header self-containment checks pass, and no counter symbol in the release
archive.

tests/test_measure.cpp

@@ -1,8 +1,9 @@
 #include "harness.hpp"
 #include <plot/plot/measure.hpp>
 #include <plot/data/array_series.hpp>
+#include <plot/data/detail/cover_count.hpp>
 #include <algorithm>
-#include <chrono>
+#include <atomic>
 #include <cmath>
 #include <vector>
 
@@ -25,15 +26,35 @@ PLOT_TEST(measurement_over_interval_matches_direct_computation) {
   PLOT_CHECK_NEAR(m.dx, 699.0, 1e-9);
 }
 PLOT_TEST(measurement_uses_pyramid_not_scan) {
-  // Guard against a future regression that linear-scans the series: a huge
-  // series must evaluate a 1-sample-wide interval in well under a millisecond.
-  std::vector<f32> y(1u << 22, 1.0f);              // 4M samples
-  plot::data::ArraySeries s(std::move(y), 0.0, 1.0);
-  const auto t0 = std::chrono::steady_clock::now();
-  for (int i = 0; i < 1000; ++i) (void)plot::Measure::evaluate(s, 1'000'000, 1'000'001);
-  const auto us = std::chrono::duration_cast<std::chrono::microseconds>(
-      std::chrono::steady_clock::now() - t0).count();
-  PLOT_CHECK(us < 50'000);                          // 1000 evals in < 50 ms
+  // Guard against a future regression that linear-scans the series, counted rather
+  // than timed: a query's cost is the pyramid's covering decomposition -- at most
+  // two entries per level -- so the entry count must depend on the *interval* and
+  // never on the series length. The wall-clock bound this replaced (1000 evals in
+  // < 50 ms) failed on a loaded machine and passed vacuously on a fast one, while
+  // saying nothing about the shape of the work.
+  std::vector<f32> big(1u << 22, 1.0f);            // 4M samples
+  plot::data::ArraySeries s_big(std::move(big), 0.0, 1.0);
+  std::vector<f32> small(1u << 13, 1.0f);          // 8k samples: 512x shorter
+  plot::data::ArraySeries s_small(std::move(small), 0.0, 1.0);
+
+  auto covers = [](const plot::data::Series& s, u64 begin, u64 end) {
+    plot::data::detail::cover_entry_count().store(0, std::memory_order_relaxed);
+    (void)plot::Measure::evaluate(s, begin, end);
+    return plot::data::detail::cover_entry_count().load(std::memory_order_relaxed);
+  };
+
+  // The same absolute interval over both series walks the same run of level-0
+  // buckets, so it must fold the same entries: a decomposition that degenerated
+  // with series length -- one bucket at a time, or a scan -- shows up here.
+  const u64 big_covers = covers(s_big, 1024, 7000);
+  PLOT_CHECK(big_covers == covers(s_small, 1024, 7000));
+  PLOT_CHECK(big_covers > 0u);                     // the interior came from the pyramid
+  PLOT_CHECK(big_covers <= 32u);                   // ~2 entries per level, few levels here
+
+  // A 1-sample interval needs no whole bucket at all: its answer is the two partial
+  // edge buckets a pyramid of complete buckets cannot cover (at most 2 * kBucket raw
+  // samples through copy_raw), so it folds nothing whatever the series holds.
+  PLOT_CHECK(covers(s_big, 1'000'000, 1'000'001) == 0u);
 }
 PLOT_TEST(empty_and_single_sample_intervals_are_valid_false) {
   std::vector<f32> y{3.0f};