perf(desktop): remove X11 staging copies and preserve receipt progress

[rldyourmnd]

The X11 software producer copied each Full HD capture into an 8 MiB owned BGRA staging frame before conversion. It now synchronously borrows the completed MIT-SHM mapping through conversion and encode, removing that allocation/copy while preserving owned capture consumers and the plain GetImage fallback. Downscaling reads the view directly and allocates only its scaled output. Codec settings, quality, FPS, recovery and wire behavior remain unchanged.

The callback lifetime and exclusive capturer borrow prevent another capture from overwriting the mapping while it is consumed. No new unsafe code or dependencies are added. Native fixtures check mapping identity, successive paints, independent owned snapshots and fallback; a real-codec test requires byte-identical output from borrowed and owned input through explicit recovery.

Five alternating pairs of 600 Full HD copy/conversion samples measured 3.487 ms → 1.848 ms median per frame (47.0% less elapsed time for this isolated stage). The committed report and raw samples explicitly exclude the encoder, X11 request, transport and viewer; this is not a whole-agent CPU claim.

Validation: macOS x11-feature clippy, borrowed/owned real-codec and scaling tests; session_v2 (13), frame_cadence (2), recovery_requests (1). Linux x11 clippy, 101 library tests and the Full HD Xvfb capture fixture passed. Required PR checks validate both OSes, feature lanes, native fixtures and supply chain.

Evidence: docs/reports/rds-desktop-cpu-20261008.md and linked frozen benchmark/raw data. The allocation-only experiment did not improve its paired benchmark and is absent from the final code. The final merge should squash the implementation/evidence into this cohesive increment.

The final increment also fixes a completion case in the preceding incremental receipt optimization: Superseded(next) means the current payload was fully written, so it must install its digest before FIN. A new real QUIC 32 MiB backpressure regression failed on the original Iroh path and passes on Iroh/Noq after correction, including receipt delivery and admission release. No additional payload hash pass is introduced.

The initial final macOS CI failed the pre-existing Noq ACK-starvation fixture because it started its two-second recovery clock before contemporaneous sibling proof. The test now fences the real ACK during the failed work interval first; production policy and the two-second recovery bound are unchanged. All five local blackhole/path fixtures pass. Original failure and the narrower timing boundary are retained in the report.