Clarify render ownership and synchronize presentation teardown

[elcritch]

Siwin renderers could retain their host window while the window's render callback retained the renderer, preventing immediate cleanup. Borrow the host window instead and require callers to keep it alive through rendering and renderer destruction. Add finishPendingFrames so hosts can wait for submitted GPU work before destroying presentation targets.

Render data now has an explicit downward-only ownership contract. Only the recursive RenderFragment and diagnostic RenderTree need {.acyclic.}; Nim infers the remaining render-data types. Fragment moves already reject self/descendant attachment, and new regressions preserve that invariant. Renderer and backend types remain cycle-capable.

The ownership guide documents exclusive ARC/ORC transfer, the borrowed window lifetime, and the separate requirement to retire source-thread ORC registrations before transferring a renderer. Merenda handles that final step for renderer commands in elcritch/merenda#117. Prepare version 0.43.0 for this API addition.

Validation on macOS/arm64, Nim 2.2.12:

• Focused ownership, fragment, font, and Siwin suites: 79 tests passed under ARC and 79 under ORC; the ORC run used Clang ASan/UBSan with halt-on-error.
• The callback regression observes immediate context destruction when the window leaves scope; it failed before the borrow change.
• Merenda's ORC ownership subset: 94 tests passed under ASan/UBSan, including native dedicated Metal frames, full/incremental retained scenes, delayed renderer release, and exception cleanup.
• Formatting and whitespace checks passed. Vulkan was not compiled or exercised locally because the workspace lacks pkg/vulkan; its completion operation uses vkDeviceWaitIdle.

FigDraw tests:

atlas-run tests renderownership renderfragments fontutils siwin_dedicated_render
UBSAN_OPTIONS=halt_on_error=1:print_stacktrace=1 atlas-run tests renderownership renderfragments fontutils siwin_dedicated_render -- --mm:orc --cc:clang -d:useMalloc -d:noSignalHandler --debugger:native --passC:'-fsanitize=address,undefined -fno-omit-frame-pointer' --passL:'-fsanitize=address,undefined'

This change covers the static Siwin integration. Other window shims and the native dynlib retain their existing lifetime contracts. OS-driven teardown barriers on Windows/X11 remain separate Siwin work.