feat(render): Campaign V slice V4a - port TextRenderer/BitmapFont/DebugLineRenderer/TextureCache onto IGpuDevice

TextRenderer, BitmapFont, DebugLineRenderer, and TextureCache's UI-texture
upload path (GetOrUploadRenderSurface/UploadRgba8) now issue every draw and
resource creation through the pinned IGpuDevice/IGpuFrame/IGpuPassEncoder
RHI contract instead of raw GL. This is the RHI's first real production
consumer - V0-V3 only established the contract, GL backend skeleton, and a
shader-dialect migration with no live GL exercise. TextRenderer owns one
IGpuPipeline (ui_text shader, straight-alpha blend, depth disabled) and
allocates a per-bucket ring each Flush; BitmapFont's atlas texture is
created and uploaded via device.CreateTexture/.Upload; DebugLineRenderer
mirrors the same one-pipeline-per-Flush shape for its line-list draws.
World-path TextureCache methods (GetOrUpload, the raw-GL layer-array
upload) are untouched - still legacy GL, still out of scope.

Frame lifecycle: GpuDeviceFrameLifetime (RenderFrameOrchestrator.cs) wraps
IGpuDevice.BeginFrame()/IGpuFrame.End() inside the existing
IRenderFrameLifetime bracket HostInputCameraCompositionPhase already opens
per callback, additively - no frame-graph restructuring. Ported renderers
reach the frame via ICurrentGpuFrameSource, a plain interface (not a
delegate field) so WorldSceneDiagnosticsController keeps passing its
existing "no stored window/delegate" architectural-conformance test.

Two real bugs surfaced by actually exercising the RHI against a live GL
context (nothing here was previously reachable before this slice):

- GlGpuDevice.BeginFrame() now resets the render-state cache every frame.
  The cache assumes it is the sole writer of GL program/blend/depth/cull
  state, which was true while it had zero real consumers, but every
  still-legacy renderer (WbDrawDispatcher, terrain, particles, EnvCells)
  mutates that same GL state directly and never informs the cache. Once a
  legacy renderer ran between two RHI binds, the cache's belief about the
  current GL program went stale, so a later BindPipeline(text shader)
  skipped re-issuing glUseProgram and the following push-constant upload
  threw GL_INVALID_OPERATION against whatever program was actually bound.
  Reset() at the frame boundary is the same defensive move BeginPass
  already makes after a forced clear (see its comment); it costs one
  redundant state application on the frame's first bind.
- GL_MULTISAMPLE has no representation in the pinned contract. Added a
  GL-backend-internal Multisample field to GlRenderStateSnapshot/Changes,
  computed from GpuPipelineDescription.SampleCount at BindPipeline time -
  mirrors how Vulkan bakes MSAA into the pipeline instead of a separate
  toggle.

Collateral, scoped to keep the port real rather than a stub:

- GpuTextureSlot (Unassigned = uint.MaxValue, NOT 0) now flows through
  every consumer of TextureCache.GetOrUploadRenderSurface/UploadRgba8 and
  TextRenderer.DrawSprite - the entire retained UI layer, since a pervasive
  Func<uint,(uint,int,int)> sprite-resolve delegate threads through nearly
  every UI element/controller. Every prior `== 0` / `!= 0` "no texture"
  check became `.IsAssigned` / `!.IsAssigned`; slot 0 is a real assigned
  slot (the device's default white texture), so the old sentinel would
  have produced live visual regressions if left in place.
- GpuTextureSlot/IGpuDevice/IGpuFrame are internal, so ~270 previously
  public AcDream.App types that touched them (directly or transitively)
  are now internal too - safe, since AcDream.App is an exe with no
  external project references; only the two test projects consume it, via
  InternalsVisibleTo. A handful of unrelated types the sweep caught
  (ElementInfo/ImportedLayout's property-bag hierarchy, several enums used
  as public [Theory] parameters, CursorFeedbackSnapshot's DragAcceptState)
  were reverted back to public where making them internal would have
  either cascaded into unrelated files or broken xUnit's public-member
  discovery.
- ExternalViewportTextureBridge (new) registers the still-raw-GL FBO
  color textures PrivateEntityViewportRenderer/PaperdollViewportRenderer
  produce (V4g's scope) into the device's texture table for
  UiViewport.TextureHandle, via a temporary
  GlGpuDevice.RegisterExternalColorTexture escape hatch (internal, not
  part of IGpuDevice) deleted when V4g ports those viewports.
- TextRenderGlStateScope.cs and its test deleted: the pipeline description
  now bakes what it used to restore by hand.
- ResourceCleanupGroupTests/GlTextureOwnershipTests: the two source-text
  conformance tests keyed to TextRenderer's old multi-resource
  construction shape (Shader + per-flight FrameBufferSet array + white
  texture + tracked VAO/VBO, all via ResourceCleanupGroup) no longer apply
  - that shape is gone, replaced by one IGpuPipeline created through
    IGpuDevice. The construction-order test is deleted; the checked-commit
    texture-creation check now targets GlGpuTexture (which already used
    the same GlResourceCommand.CreateName primitive before this slice).

Gates:
- dotnet build -c Release: 0 warnings, 0 errors (AcDream.App has
  TreatWarningsAsErrors).
- dotnet test tests/AcDream.App.Tests -c Release: 3,840 passed / 3
  skipped (was 3,843/3 entering this slice - net 3 fewer tests:
  TextRendererFailureSafetyTests.cs deleted (2, tested the now-deleted
  TextRenderGlStateScope) plus the one retired ResourceCleanupGroupTests
  method). Full solution: 8,908 passed / 5 skipped across all nine test
  projects.
- Offline pixel gate (tools/run-offline-pixel-gate.ps1, parent ec414d60
  vs this commit): differing fraction 0.318% (1,791/563,200 compared
  pixels), above the 0.001 threshold. Investigated pixel-by-pixel rather
  than waved through: a diff heatmap plus 4x crops at the differing
  clusters show zero differences anywhere in the retained UI, terrain,
  scenery, or static meshes - every differing pixel sits on continuously-
  animated ambient content (flying-insect sprites over the swamp, foliage
  sparkle/dew glints) whose exact phase depends on elapsed wall-clock
  time, the same category the gate's own sky-masking rationale already
  documents and the campaign doc's coverage table explicitly excludes
  ("Not covered - particles"). Confirming evidence: two same-commit
  captures at HEAD compare clean against each other (0.0025%), and two
  same-commit captures at the parent compare clean against each other
  (0.0044%) - only base-vs-head is consistently elevated, which is what
  frame-pacing drift from genuinely new per-frame RHI work (BeginFrame,
  ring resets, the render-state reset above) would produce against a
  fixed wall-clock capture deadline, not a rendering defect. Recommend a
  quick user visual check of this capture pair alongside the automated
  result, matching how V2c's particle work was already handled in this
  campaign (flagged for user visual confirmation rather than blocked on
  an automated gate that cannot cover animated content).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/AcDream.App/Rendering/DollEntityBuilder.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Collections.Generic;
 using System.Numerics;
 using AcDream.Core.World;
@@ -6,13 +6,13 @@ using AcDream.Core.World;
 namespace AcDream.App.Rendering;
 
 /// <summary>
-/// Builds the dedicated paperdoll WorldEntity — retail's <c>makeObject(player)</c>
+/// Builds the dedicated paperdoll WorldEntity — retail's <c>makeObject(player)</c>
 /// clone: the player's Setup id + current ObjDesc (base palette + subpalette overlays
 /// + part overrides), posed at the scene origin facing the viewer.
 ///
 /// <para>
 /// The palette / part-override mapping mirrors the inline construction in
-/// <c>GameWindow.cs</c> around lines 3390–3431. Extracted here so it is
+/// <c>GameWindow.cs</c> around lines 3390–3431. Extracted here so it is
 /// unit-testable without dats and so the paperdoll renderer owns a clean
 /// seam: it calls <see cref="Build"/> with fresh player state each time the
 /// ObjDesc changes, and the renderer only has to swap the entity into its
@@ -26,7 +26,7 @@ namespace AcDream.App.Rendering;
 /// server-assigned guid.
 /// </para>
 /// </summary>
-public static class DollEntityBuilder
+internal static class DollEntityBuilder
 {
     /// <summary>
     /// Reserved synthetic guid for the paperdoll clone. High, deliberately
@@ -38,18 +38,18 @@ public static class DollEntityBuilder
     /// Reserved render-local entity id for the doll. FIXED (the doll is a singleton)
     /// and high enough never to collide with LiveEntityRuntime's local ids. The
     /// renderer passes this in <c>animatedEntityIds</c> so the dispatcher treats the
-    /// doll as animated — which BYPASSES the Tier-1 classification cache
+    /// doll as animated — which BYPASSES the Tier-1 classification cache
     /// (WbDrawDispatcher.cs:1142). That matters because a re-dress builds a NEW
     /// WorldEntity with this SAME id; without the cache bypass the dispatcher would
     /// serve the previous doll's cached batches and the new gear wouldn't appear.
     /// </summary>
     public const uint DollRenderId = 0xDA11_D012u;
 
-    // retail RedressCreature: CPhysicsObj::set_heading(191.367905°) (decomp 0x004a3c0a). Frame::set_heading(h)
-    // (decomp 0x00535e40) builds the facing vector as (sin h°, cos h°, 0): at h=0 the creature faces +Y (AC
+    // retail RedressCreature: CPhysicsObj::set_heading(191.367905°) (decomp 0x004a3c0a). Frame::set_heading(h)
+    // (decomp 0x00535e40) builds the facing vector as (sin h°, cos h°, 0): at h=0 the creature faces +Y (AC
     // North), the heading increasing CLOCKWISE toward +X. We rotate the doll's default +Y-forward body about
-    // +Z; System.Numerics rotates +Y → (−sin θ, cos θ), so to land on retail's (sin h, cos h) the angle is
-    // NEGATED (θ = −h). Using +h mirrors the X-lean (~22° off → the face reads as turned away from the viewer).
+    // +Z; System.Numerics rotates +Y → (−sin θ, cos θ), so to land on retail's (sin h, cos h) the angle is
+    // NEGATED (θ = −h). Using +h mirrors the X-lean (~22° off → the face reads as turned away from the viewer).
     private const float _headingDegrees = 191.367905f;
     private static readonly float _headingRad = -_headingDegrees * (MathF.PI / 180f);
     private static readonly Quaternion _dollRotation =
@@ -62,17 +62,17 @@ public static class DollEntityBuilder
     /// <param name="meshRefs">Pre-resolved mesh refs (may be empty; caller fills them in).</param>
     /// <param name="basePaletteId">
     /// ObjDesc base palette id (0x04xxxxxx). Passed only when subpalettes are
-    /// also present — mirrors GameWindow which only builds a PaletteOverride
+    /// also present — mirrors GameWindow which only builds a PaletteOverride
     /// when <c>SubPalettes.Count &gt; 0</c>.
     /// </param>
     /// <param name="subPalettes">
     /// Subpalette overlays from the server ObjDesc. Each tuple carries the
     /// subpalette dat id, byte offset into the base palette, and byte length.
-    /// Null or empty → <c>PaletteOverride</c> on the returned entity is null.
+    /// Null or empty → <c>PaletteOverride</c> on the returned entity is null.
     /// </param>
     /// <param name="partOverrides">
     /// AnimPartChange swaps from the server ObjDesc. Each tuple is a
-    /// (PartIndex, replacement GfxObj id) pair. Null or empty → empty array.
+    /// (PartIndex, replacement GfxObj id) pair. Null or empty → empty array.
     /// </param>
     public static WorldEntity Build(
         uint setupId,
@@ -82,7 +82,7 @@ public static class DollEntityBuilder
         IReadOnlyList<(byte PartIndex, uint GfxObjId)>? partOverrides = null)
     {
         // --- palette override (mirrors GameWindow:3395-3405) ---
-        // Only build when there are sub-palette overlays — same gate as GameWindow.
+        // Only build when there are sub-palette overlays — same gate as GameWindow.
         PaletteOverride? paletteOverride = null;
         if (subPalettes is { Count: > 0 } spList)
         {