fix(device): drain GPU work before teardown

[besmpl]

Summary

Make Device.Release wait for the HAL device to become idle before releasing pending writes, flushing deferred destruction, destroying pooled encoders, and finally destroying the core/HAL device.

The public WaitIdle method still rejects calls after release. Teardown uses a private waitIdle path because Release marks the device unavailable first, preventing concurrent new work while the final submission is drained.

Why

The previous order set the released bit and then called the public WaitIdle, which immediately returned ErrReleased. Deferred encoder-recycling callbacks could therefore remain queued while HAL destruction reclaimed the same command pools.

Validation

• go test ./...
• go test -race .
• a lifecycle test proves WaitIdle happens before HAL Destroy

This is intentionally separate from the Android work; it fixes native teardown ordering on every backend.

Android preview relationship

This Android-independent prerequisite is stacked into draft #268 at exact head 0ed17064f8c977f35d9b49b5cde0d0c69e867ecf. The draft will rebase it out after merge; Android runtime claims remain gated in that PR.

[besmpl]

Stacked consumer preview: #268 at exact head b11d2671e80081a191705c41c4e77e8b61472017 incorporates this PR's head 0ed17064f8c977f35d9b49b5cde0d0c69e867ecf (matching stable patch ID).

The preview remains explicitly draft/non-mergeable and will be rebased to Android-only commits after this prerequisite lands.