Refactor WebGPU surface lifecycle to support latched attach

[wcandillon]

fixes #414

Summary

Stabilizes the surface lifecycle behind the synchronous getContext("webgpu") contract. The offscreen-fallback model stays (it is what gives fast time-to-first-frame on Android), but the reconciliation points between the asynchronous native surface lifecycle and the synchronous WebGPU API are reworked around explicit invariants instead of ad-hoc state swaps.

Key changes

Ownership: registry entries live exactly as long as their JS Canvas

• Surface destruction alone (backgrounding, TextureView teardown) now only detaches — it never removes the registry entry. This fixes the orphaned-context black screen on the transparent/TextureView path and the SurfaceView/TextureView asymmetry.
• Entry removal happens in exactly two places: native view teardown (MetalView.dealloc / WebGPUViewManager.onDropViewInstance) when a surface is attached, and the new RNWebGPU.destroyContext (Canvas unmount cleanup) when none ever was. The split keeps React StrictMode's simulated unmount — which re-runs effects without unmounting native views — from orphaning a live surface.
• destroyContext's check-and-erase and the platform attach both run atomically under the registry lock (SurfaceRegistry::attachSurface / removeSurfaceInfoIfDetached), so they can never orphan each other. Lock order is strictly registry → SurfaceInfo.
• The registry is cleared on RNWebGPUManager teardown so dev reloads cannot alias new canvases onto stale entries; all native-side registry lookups are null-checked.

Latched attach, immediate detach

• Surface attaches are stored as pending by the UI thread and adopted at frame boundaries (start of getCurrentTexture / end of present) on whichever thread renders (main JS, Reanimated UI, worklet runtimes) — preserving Dawn surface thread-affinity and guaranteeing a surface is never swapped mid-frame. A CallInvoker flush covers contexts that are not actively rendering, so static content still appears.
• Surface detaches stay immediate (the platform destroys the surface synchronously); a configured context falls back to offscreen rendering and the in-flight frame is dropped at present().
• present() only presents frames whose texture was actually acquired from the attached surface — eliminating present-without-acquire validation errors around transitions. A _frameEpoch counter revalidates the deferred blit-present so it can never race a frame that completed while the lock was released.

Blit & error-path correctness

• The offscreen→onscreen blit checks SurfaceTexture.status, clamps the copy extent to the shared region (rotation while detached), presents from the rendering thread, and no longer permanently widens the configured usage with CopyDst.
• getCurrentTexture() checks SurfaceTexture.status (reconfigure + retry once, then offscreen fallback), throws a catchable JS error when called before configure() instead of dereferencing a null device, and clamps zero-sized canvases to 1×1. unconfigure() is now implemented.
• viewFormats are deep-copied into SurfaceInfo; the stored configuration previously kept a pointer into Convertor-owned memory that died with the configure() call.

Native resource ownership

• ANativeWindow references are released on every path (the acquire in onSurfaceCreate was never paired); iOS retains the CAMetalLayer for the lifetime of the attach (releasing on the main queue), fixing a use-after-free when a dev reload cleared the registry before dealloc could cancel a pending attach. Both flow through a per-attach NativeSurfaceReleaser, balanced on every replace/cancel/adopt/destroy path.
• Removes the dead WebGPUBaseView (its JNI bindings never existed) and the onSurfaceDestroy path.

Verification

• Real Dawn headers regenerated from the pinned submodule commit (chromium/7849); all changed C++ syntax-checked under g++ and clang++. TS typecheck (all workspaces), ESLint, cpplint clean.
• A sanitizer stress test exercises the transition state machine (4 threads: attach/detach churn, flush, frame loop, registry probes, plus registry-level attach vs remove-if-detached arbitration) — clean under ThreadSanitizer and ASan/UBSan, 26k native-window cycles balanced exactly.
• Adversarial multi-agent review (5 lenses, 3-vote verification per finding) confirmed 3 defects — all fixed in follow-up commits and re-verified against their exact failure interleavings.
• Not covered here: on-device builds of MetalView.mm and the Java/JNI changes (no Apple SDK/NDK in the environment) — platform smoke tests recommended before merge.

[github-actions]

🎉 This PR is included in version 0.6.1 🎉

The release is available on:

• v0.6.1
• GitHub release

Your semantic-release bot 📦🚀