fix(metal): pin autorelease pools to OS threads

[besmpl]

Summary

• pin each Objective-C autorelease pool to the OS thread where it is created
• make drain terminal and balance the thread lock even when creation or drain panics
• defer pool cleanup immediately at encoder call sites so recovered panics cannot strand a goroutine on an OS thread
• cover nesting, zero/double drain, panic cleanup, scheduler yields, and Metal resource stress

This is extracted from #253 as an independent Metal runtime correctness fix. It does not include indexed-indirect, ICB, pipeline, or material-page changes.

Verification

• CGO_ENABLED=0 go test -count=1 ./hal/metal
• CGO_ENABLED=1 go test -race -count=1 -run '^TestAutoreleasePool' ./hal/metal
• GOOS=darwin GOARCH=arm64 CGO_ENABLED=0 go test -run '^$' ./hal/metal
• repeated native autorelease and resource stress tests on Apple Silicon
• git diff --check

The full Metal race suite still encounters a pre-existing goffi/checkptr failure in TestCAMetalLayerDrawableSize; the focused autorelease race suite passes.