feat(studio): one shell for the workspaces, and the headless render harness

[sp00ktober]

For sp00ktober/MHFU-ModKit#67, 1 of 3: the map and monster workspaces stack on this.

• apps/studio (mhfu-studio, GPL-3.0-or-later, uv run studio), a new workspace member.
• One shell. The two editors each carried a copy of these; now there is one of each:
  • the GL context (EGL when there is no display) and the offscreen target;
  • the orbit camera (the two editors' cameras differ only by a Lens);
  • the shader cache, lines and the viewport base.
• The window:
  • one hello_imgui runner, with a docking layout per workspace;
  • File and Edit menus, undo/redo keys, and a Findings window;
  • all of this through two protocols: Document (shell/document.py, with a snapshot History) and Workspace (shell/workspace.py), which the workspaces register against.
• One finding type: Finding(level, code, message, where, target). Its target lets the workspace jump to the finding.
• Headless harness (supersedes sp00ktober/MHFU-ModKit#13 and sp00ktober/MHFU-ModKit#46):
  • offscreen renders and contact sheets;
  • statistics goldens (coverage, per-cell coverage, means, histogram), never images;
  • exact hashes on the pinned renderer;
  • studio render selftest.
• docker/run.sh: a pinned Mesa llvmpipe image for the tests and studio render. The repo is mounted, and output outside the mount is refused.
• CI: the test job installs Mesa and the X11 headers, because glcontext has no 3.14 wheel.
• Fixed: the offscreen target leaked its renderbuffers on every resize, about 98 MB per resize at 4x MSAA.

Test plan

• uv run pytest, pre-commit run --all-files, and the CI jobs in a Linux container (3.11, 3.14, Mesa 22.3)
• Camera, wire builders and a synthetic scene match the old editors: 14 of 14 images pixel-identical
• Selftest golden: exact hash in the container, statistics within tolerance on macOS
• Real-window smoke (MHFU_UI_SMOKE=1)

🤖 Generated with Claude Code