fix(linux): harden EGL texture ownership

[nmfisher]

Summary

Follow-up ownership hardening for the Linux EGL bootstrap and DMA-BUF transport introduced by #273, rebased onto the timing-only scheduler refactor from #278.

• selects the DRM render node backing Flutter's captured EGLDisplay instead of assuming renderD128
• retains every deferred texture-readiness call and cancels or resolves each call safely
• releases Flutter GL/EGL consumer resources before OpenGL or Vulkan producer contexts
• unreferences texture objects on registrar failures and during normal teardown
• clears the exported plugin instance before texture/context disposal begins
• uses one texture-publication helper for both the platform-channel and direct Dart notifier paths
• performs NeedsBlit / BlitToExport for Linux Vulkan before either path marks a texture available to Flutter

Multi-viewer lifecycle hardening (3a7b54f)

Follow-up commit addressing scenarios where several ViewerWidgets bootstrap concurrently and every viewer resize destroys and recreates its platform texture:

• keeps the thermion_flutter_render_* raster-context capture across destroy_all_contexts — it describes Flutter's context, which outlives plugin-owned contexts; resetting it on a bootstrap-only teardown leaked sibling bootstrap GL names and could fail a sibling viewer's pending getDriverPlatform with CONTEXT_NOT_READY. Cleared only in plugin dispose, re-captured by populate() on context change.
• serializes populate() (raster thread) against release_texture() (platform thread) with a per-texture GMutex. Flutter's Linux registrar lookup hands populate() a raw pointer with no reference and no synchronization with unregistration, so a destroy issued mid-import could close the producer's DMA-BUF fd during eglCreateImageKHR, and pending_ready_calls was mutated from both threads. populate() now bails on destroyed textures.
• retains the small GObject shell of destroyed textures until plugin teardown instead of unreffing eagerly, so a late populate() can never touch a finalized object or its mutex; all heavyweight native resources are still released eagerly
• dup()s the DMA-BUF fd into the consumer texture so producer teardown can never invalidate a concurrent import
• dispatches producer teardown by external_images ownership rather than opengl_context presence — surface ids are per-context counters, so a misroute in a mixed-backend state could destroy an unrelated live surface

Integration with #278

This does not restore the removed native render loop or couple FrameScheduler back to rendering. The exported plugin handle is used only by Dart's post-render Linux texture notifier.

The direct notifier now has the same Vulkan publication semantics as markTextureFrameAvailable: any intermediate Vulkan image is copied to its exported DMA-BUF before Flutter is notified. The plugin handle is cleared before disposal so a late Dart notification cannot acquire an object whose native resources are being torn down.

Validation

• rebased onto current develop
• flutter analyze in thermion_flutter: clean (22e1740)
• full thermion_flutter test suite: 29 tests passed (22e1740)
• git diff --check: clean
• full GitHub Actions matrix passed on 22e1740, including Linux native compilation, Linux Dart/OpenGL tests, Linux Flutter builds, Windows, macOS, and Android
• 3a7b54f (follow-up hardening): Linux native compilation is CI-gated — no Linux toolchain on macOS; flutter analyze unchanged from 22e1740 (no Dart files touched); git diff --check clean