feat(render): Campaign V slice V4a - port TextRenderer/BitmapFont/DebugLineRenderer/TextureCache onto IGpuDevice

TextRenderer, BitmapFont, DebugLineRenderer, and TextureCache's UI-texture
upload path (GetOrUploadRenderSurface/UploadRgba8) now issue every draw and
resource creation through the pinned IGpuDevice/IGpuFrame/IGpuPassEncoder
RHI contract instead of raw GL. This is the RHI's first real production
consumer - V0-V3 only established the contract, GL backend skeleton, and a
shader-dialect migration with no live GL exercise. TextRenderer owns one
IGpuPipeline (ui_text shader, straight-alpha blend, depth disabled) and
allocates a per-bucket ring each Flush; BitmapFont's atlas texture is
created and uploaded via device.CreateTexture/.Upload; DebugLineRenderer
mirrors the same one-pipeline-per-Flush shape for its line-list draws.
World-path TextureCache methods (GetOrUpload, the raw-GL layer-array
upload) are untouched - still legacy GL, still out of scope.

Frame lifecycle: GpuDeviceFrameLifetime (RenderFrameOrchestrator.cs) wraps
IGpuDevice.BeginFrame()/IGpuFrame.End() inside the existing
IRenderFrameLifetime bracket HostInputCameraCompositionPhase already opens
per callback, additively - no frame-graph restructuring. Ported renderers
reach the frame via ICurrentGpuFrameSource, a plain interface (not a
delegate field) so WorldSceneDiagnosticsController keeps passing its
existing "no stored window/delegate" architectural-conformance test.

Two real bugs surfaced by actually exercising the RHI against a live GL
context (nothing here was previously reachable before this slice):

- GlGpuDevice.BeginFrame() now resets the render-state cache every frame.
  The cache assumes it is the sole writer of GL program/blend/depth/cull
  state, which was true while it had zero real consumers, but every
  still-legacy renderer (WbDrawDispatcher, terrain, particles, EnvCells)
  mutates that same GL state directly and never informs the cache. Once a
  legacy renderer ran between two RHI binds, the cache's belief about the
  current GL program went stale, so a later BindPipeline(text shader)
  skipped re-issuing glUseProgram and the following push-constant upload
  threw GL_INVALID_OPERATION against whatever program was actually bound.
  Reset() at the frame boundary is the same defensive move BeginPass
  already makes after a forced clear (see its comment); it costs one
  redundant state application on the frame's first bind.
- GL_MULTISAMPLE has no representation in the pinned contract. Added a
  GL-backend-internal Multisample field to GlRenderStateSnapshot/Changes,
  computed from GpuPipelineDescription.SampleCount at BindPipeline time -
  mirrors how Vulkan bakes MSAA into the pipeline instead of a separate
  toggle.

Collateral, scoped to keep the port real rather than a stub:

- GpuTextureSlot (Unassigned = uint.MaxValue, NOT 0) now flows through
  every consumer of TextureCache.GetOrUploadRenderSurface/UploadRgba8 and
  TextRenderer.DrawSprite - the entire retained UI layer, since a pervasive
  Func<uint,(uint,int,int)> sprite-resolve delegate threads through nearly
  every UI element/controller. Every prior `== 0` / `!= 0` "no texture"
  check became `.IsAssigned` / `!.IsAssigned`; slot 0 is a real assigned
  slot (the device's default white texture), so the old sentinel would
  have produced live visual regressions if left in place.
- GpuTextureSlot/IGpuDevice/IGpuFrame are internal, so ~270 previously
  public AcDream.App types that touched them (directly or transitively)
  are now internal too - safe, since AcDream.App is an exe with no
  external project references; only the two test projects consume it, via
  InternalsVisibleTo. A handful of unrelated types the sweep caught
  (ElementInfo/ImportedLayout's property-bag hierarchy, several enums used
  as public [Theory] parameters, CursorFeedbackSnapshot's DragAcceptState)
  were reverted back to public where making them internal would have
  either cascaded into unrelated files or broken xUnit's public-member
  discovery.
- ExternalViewportTextureBridge (new) registers the still-raw-GL FBO
  color textures PrivateEntityViewportRenderer/PaperdollViewportRenderer
  produce (V4g's scope) into the device's texture table for
  UiViewport.TextureHandle, via a temporary
  GlGpuDevice.RegisterExternalColorTexture escape hatch (internal, not
  part of IGpuDevice) deleted when V4g ports those viewports.
- TextRenderGlStateScope.cs and its test deleted: the pipeline description
  now bakes what it used to restore by hand.
- ResourceCleanupGroupTests/GlTextureOwnershipTests: the two source-text
  conformance tests keyed to TextRenderer's old multi-resource
  construction shape (Shader + per-flight FrameBufferSet array + white
  texture + tracked VAO/VBO, all via ResourceCleanupGroup) no longer apply
  - that shape is gone, replaced by one IGpuPipeline created through
    IGpuDevice. The construction-order test is deleted; the checked-commit
    texture-creation check now targets GlGpuTexture (which already used
    the same GlResourceCommand.CreateName primitive before this slice).

Gates:
- dotnet build -c Release: 0 warnings, 0 errors (AcDream.App has
  TreatWarningsAsErrors).
- dotnet test tests/AcDream.App.Tests -c Release: 3,840 passed / 3
  skipped (was 3,843/3 entering this slice - net 3 fewer tests:
  TextRendererFailureSafetyTests.cs deleted (2, tested the now-deleted
  TextRenderGlStateScope) plus the one retired ResourceCleanupGroupTests
  method). Full solution: 8,908 passed / 5 skipped across all nine test
  projects.
- Offline pixel gate (tools/run-offline-pixel-gate.ps1, parent ec414d60
  vs this commit): differing fraction 0.318% (1,791/563,200 compared
  pixels), above the 0.001 threshold. Investigated pixel-by-pixel rather
  than waved through: a diff heatmap plus 4x crops at the differing
  clusters show zero differences anywhere in the retained UI, terrain,
  scenery, or static meshes - every differing pixel sits on continuously-
  animated ambient content (flying-insect sprites over the swamp, foliage
  sparkle/dew glints) whose exact phase depends on elapsed wall-clock
  time, the same category the gate's own sky-masking rationale already
  documents and the campaign doc's coverage table explicitly excludes
  ("Not covered - particles"). Confirming evidence: two same-commit
  captures at HEAD compare clean against each other (0.0025%), and two
  same-commit captures at the parent compare clean against each other
  (0.0044%) - only base-vs-head is consistently elevated, which is what
  frame-pacing drift from genuinely new per-frame RHI work (BeginFrame,
  ring resets, the render-state reset above) would produce against a
  fixed wall-clock capture deadline, not a rendering defect. Recommend a
  quick user visual check of this capture pair alongside the automated
  result, matching how V2c's particle work was already handled in this
  campaign (flagged for user visual confirmation rather than blocked on
  an automated gate that cannot cover animated content).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/AcDream.App/UI/Layout/CharacterSheetProvider.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Collections.Generic;
 using AcDream.Core.Items;
 using AcDream.Core.Player;
@@ -18,7 +18,7 @@ namespace AcDream.App.UI.Layout;
 /// cited there too (gmAttributeUI::GetCostToRaise 0x0049cb80 family).</para>
 ///
 /// <para><b>State ownership:</b> optimistic debits go through the owning
-/// store's eventful APIs — <see cref="ClientObjectTable.UpdateIntProperty"/> /
+/// store's eventful APIs — <see cref="ClientObjectTable.UpdateIntProperty"/> /
 /// <see cref="ClientObjectTable.UpdateInt64Property"/> (fires ObjectUpdated)
 /// when the player object is in the table, else
 /// <see cref="LocalPlayerState.DebitIntProperty"/> /
@@ -26,9 +26,9 @@ namespace AcDream.App.UI.Layout;
 /// Never write the raw property dictionaries from UI code. The next server
 /// snapshot remains authoritative over every optimistic value.</para>
 /// </summary>
-public sealed class CharacterSheetProvider
+internal sealed class CharacterSheetProvider
 {
-    /// <summary>PropertyInt64 2 = unassigned (banked) XP — CharacterSheet.UnassignedXp.</summary>
+    /// <summary>PropertyInt64 2 = unassigned (banked) XP — CharacterSheet.UnassignedXp.</summary>
     private const uint UnassignedXpPropertyId = 2u;
 
     /// <summary>
@@ -48,10 +48,10 @@ public sealed class CharacterSheetProvider
     private readonly Action<uint, ulong>? _sendRaiseSkill;
     private readonly Action<uint, uint>? _sendTrainSkill;
 
-    /// <summary>Portal SkillTable (0x0E000004) — set by the host once dats load.</summary>
+    /// <summary>Portal SkillTable (0x0E000004) — set by the host once dats load.</summary>
     public DatReaderWriter.DBObjs.SkillTable? SkillTable { get; set; }
 
-    /// <summary>Portal ExperienceTable (0x0E000018) — set by the host once dats load.</summary>
+    /// <summary>Portal ExperienceTable (0x0E000018) — set by the host once dats load.</summary>
     public DatReaderWriter.DBObjs.ExperienceTable? ExperienceTable { get; set; }
 
     public CharacterSheetProvider(
@@ -89,7 +89,7 @@ public sealed class CharacterSheetProvider
         return new ChangeBinding(this, changed);
     }
 
-    // ── Sheet assembly ─────────────────────────────────────────────────────
+    // ── Sheet assembly ─────────────────────────────────────────────────────
 
     /// <summary>Best display name: active toon key, else the live object's name, else "Player".</summary>
     public string CharacterName()
@@ -240,8 +240,8 @@ public sealed class CharacterSheetProvider
 
     /// <summary>
     /// Load the portal ExperienceTable (0x0E000018), falling back to a
-    /// type scan for older or odd dat collections. Failures are logged —
-    /// never silently swallowed — and leave raise costs unavailable (0).
+    /// type scan for older or odd dat collections. Failures are logged —
+    /// never silently swallowed — and leave raise costs unavailable (0).
     /// </summary>
     public static DatReaderWriter.DBObjs.ExperienceTable? LoadExperienceTable(
         IDatReaderWriter dats, Action<string>? log = null)
@@ -275,7 +275,7 @@ public sealed class CharacterSheetProvider
     }
 
     /// <summary>XP still needed for the next level + fill fraction of the
-    /// current level band (retail (cur−base)/(cap−base); CharacterSheet.XpFraction).</summary>
+    /// current level band (retail (cur−base)/(cap−base); CharacterSheet.XpFraction).</summary>
     private (long toNext, float fraction) ComputeLevelXp(int level, long totalXp)
     {
         var levels = ExperienceTable?.Levels;
@@ -394,7 +394,7 @@ public sealed class CharacterSheetProvider
     }
 
     /// <summary>Cost to advance <paramref name="amount"/> ranks along a retail
-    /// cumulative-XP curve: curve[target] − xpAlreadySpent, clamped at the
+    /// cumulative-XP curve: curve[target] − xpAlreadySpent, clamped at the
     /// curve end (retail GetCostToRaise/GetCostToRaise10 0x0049cb80/0x0049cc70).</summary>
     private static long RaiseCostFromXpCurve(uint[]? curve, uint ranks, uint spentXp, int amount)
     {
@@ -427,13 +427,13 @@ public sealed class CharacterSheetProvider
     private int VitalMax(LocalPlayerState.VitalKind kind) =>
         _localPlayer.GetMaxApprox(kind) is { } max ? checked((int)Math.Min(int.MaxValue, max)) : 0;
 
-    // ── Raise-request flow ─────────────────────────────────────────────────
+    // ── Raise-request flow ─────────────────────────────────────────────────
 
     /// <summary>
     /// Send a raise/train action to the server and, when a send delegate
     /// fired, optimistically apply the local effect so the sheet stays
     /// current during the round trip. The next server snapshot remains
-    /// authoritative (a rejected raise is corrected by the property echo —
+    /// authoritative (a rejected raise is corrected by the property echo —
     /// pending/rollback ledger tracked as a follow-up issue).
     /// </summary>
     public void HandleRaiseRequest(CharacterStatController.RaiseRequest request)