fix: unfreeze the export paths, repair shader error logging, validate the UI

[gridboy]

Stacked on #1. Base is perf/render-hot-paths, so this PR shows only its own two commits. Merge #1 first, then this retargets to main automatically.

What this changes

Fixes a permanent UI freeze, a crash on the shader error path, unsound teardown, and the missing interface validation that made the freeze reachable in the first place.

Why

The freeze. All three export actions waited for a frame like this:

while (!depth) { depth = [self createDepthData]; }

There is no exit. With the device stopped or absent, _depthUpdate never turns YES, so this pinned a core on the main thread and froze the UI for good — force quit only. Nothing grayed the export menu items out, so they stayed clickable in exactly the state where they could not work. Two clicks to reach. Now a bounded wait (-waitForDepthDataUntil:) that gives up after two seconds and says so in the status field, plus -validateMenuItem: / -validateUserInterfaceItem: so the actions gray out. AppKit validates menu and toolbar items only — plain buttons in the nib still need their enabled state bound there.

Shader errors. GLProgram.m logged compile failures with NSLog(@"...%s", desc, code) where desc is an NSString *. %s read the object pointer as a C string: garbage output or a crash, on the single path whose job is to report shader errors. code was passed and never printed. Surfaced by -Wall.

Teardown. -[GLView dealloc] released the display link without stopping it first, while its callback still draws into the view, then let closeScene issue glDelete* calls without making the view's context current — deleting whatever context happened to be bound on that thread.

Threading. _device and _halt are each written on one thread and polled on the other with no barrier. Both are now volatile. This does not fix the race, it makes explicit what the polls already rely on: opaque calls (usleep, freenect_process_events) forcing a reload. A real fix wants a condition variable.

Deprecated AppKit. runModalForDirectory:file: → setDirectoryURL: + runModal, NSOKButton → NSModalResponseOK, NSShiftKeyMask → NSEventModifierFlagShift, writeToFile:atomically: → the encoding:error: form. This raises the effective deployment target well above the 10.6 the project declares — a step toward a current SDK, not something Xcode 3 will still compile. Worth a decision before merging.

Also: mesh indices now stream through an element buffer object instead of a client-side array the driver copies inline at draw time. Note the unbind before drawFrustrum, which still draws from a client array and would otherwise have its pointer read as an offset.

How it was verified

• sh scripts/syntax-check.sh passes; GLProgram.m is now warning-clean
• Behaviour-preserving comparison — not applicable, these are behaviour changes
• Performance claims — the element buffer change is unmeasured, GPU-side
• Built in Xcode
• Run against real Kinect hardware

Unlike #1, none of this is backed by observed behaviour — it is reasoning over the code plus what -Wall reports. The freeze, the %s crash and the teardown ordering are each clear from the source, but a reviewer with hardware should confirm the export paths and the mesh still render.

Left alone deliberately

• saveSTLB has a face-detection condition mixing && and || without parentheses (-Wlogical-op-parentheses). The precedence the compiler applies may not be what the author meant; that cannot be settled without hardware, and parenthesising it would freeze one reading. Flagged, untouched.
• Point mode draws all 307200 points regardless of the detail setting. Changing it alters what the app renders.
• setAllowedFileTypes: is deprecated in favour of allowedContentTypes, which needs the UniformTypeIdentifiers framework wired into the Xcode project.
• prepareOpenGL and reshape do not call super; the video offset properties pair a synthesized setter with a hand-written getter under atomic.

Provenance

• No third-party licence header, copyright notice, CONTRIB or AUTHORS file altered
• No new vendored code