Use one surface frame metadata contract

[conxlgtm]

Summary

WaylandClient and WaylandGraphicsPreview had separate public types for the same compositor metadata. This PR replaces those parallel models with SurfaceFrameMetadata in WaylandClient. Content type, presentation hint, alpha, color representation, and damage now travel through the same internal SurfaceCommitMetadata path for direct software drawing, software fallback, managed GPU submissions, and external buffers.

Window.show and Window.redraw now each have two public forms: one direct draw and one prepared draw. Every form accepts metadata and optional presentation feedback, then returns SoftwarePresentationOutcome.

The PR also fixes the EventBroker Thread Sanitizer race. Broker state is protected by an NSLock acquired before Swift starts the guarded inout access. EventWaiter stays on Synchronization.Mutex.

Behavior

• Direct software submissions reject unsupported metadata as SurfaceFrameMetadataError before drawing, acquiring a software pool or buffer, or sending a presentation-side Wayland request.
• Prepared submissions consume and check their reservation first. Stale work returns .superseded; only current work gets final metadata capability revalidation.
• Graphics .none policy rejects nonempty metadata before submission-side window or configure work in both normal and software paths. .preferAvailable fallback behavior is unchanged.
• Supersession, metadata failures, presentation failures, and cancellation all discard reserved drawing buffers and restore presentation state correctly.
• nil is the only full-frame damage representation. A non-nil SurfaceDamageRegion contains finite, nonempty damage.
• Atomic presentation feedback remains unchanged.

Migration

This removes the graphics-prefixed metadata types:

• WaylandGraphicsDamageRegion
• WaylandGraphicsFrameMetadata
• WaylandGraphicsContentType
• WaylandGraphicsPresentationHint
• WaylandGraphicsAlphaModifier
• WaylandGraphicsColorAlphaMode
• WaylandGraphicsColorRepresentation

Callers now put damage in SurfaceFrameMetadata.damage. Color-description ownership remains package-only until the library has a managed image-description producer.

Public timeout parameters remain Int32 in this PR. Moving them to Milliseconds is a separate change.

Validation

• GitHub cheap, required-product, headless-request-path, and aggregate required checks passed.
• The full Swift test run passed 1,995 tests. Locally gated live Wayland suites were skipped; GitHub's headless request-path job passed.
• All 6 EventBrokerCancellationTests passed under Thread Sanitizer.
• wck api verify, wck docs verify, wck docc verify, and wck examples build passed.
• External public API, graphics preview, framework host, and TinyUI fixtures passed through wck ci required.
• A final read-only review found no remaining blocker after checking policy ordering, supersession precedence, public error typing, cleanup, and metadata conversion. Its focused reruns covered 45 metadata/presenter tests, 30 reservation/model tests, and 93 graphics submission tests.
• A separate ad-hoc run from fresh /tmp scratch directories passed the selected metadata, presenter, graphics, and EventBroker TSan checks.