fix(vulkan): fail closed on swapchain capability and sync errors

[besmpl]

Summary

Make Vulkan swapchain negotiation, reconfiguration, synchronization, and teardown fail closed:

• query complete surface snapshots and validate requested format/color-space, present mode, alpha mode, image usage, transform, extents, and image counts
• size image views and synchronization from the images actually returned by the driver
• keep reconfiguration transactional: retain the old swapchain until the replacement and all dependent resources are ready
• propagate query, wait, fence, reset, layout-transition, present, and teardown failures
• mark unsafe synchronization state broken so it cannot be reused
• make destruction idempotent while preserving the existing public Destroy() API

The implementation mirrors the defensive lifecycle used by Rust wgpu-hal while keeping the existing Go HAL surface.

Why

The old path accepted partial/fabricated capability state, assumed requested image counts, and could continue after synchronization or layout failures. A failed reconfigure could also tear down the working swapchain before the replacement was usable.

Validation

Go 1.25.12 and Go 1.26.5:

• go test ./hal/vulkan .
• go test -race ./hal/vulkan .
• go vet ./hal/vulkan .
• current golangci-lint v2: zero issues introduced relative to upstream/main

Failure-injection tests cover unstable counts, unsupported requests, actual image counts, lifecycle guards, broken-state rejection, transactional reconfigure, and idempotent destruction.

This correction is platform-independent and intentionally separate from the Android preview.

Android preview relationship

This Android-independent prerequisite is stacked into draft #268 at exact head a8ff52e340f0a06c8e1b6599a03856d7fc74d1a2. The draft will rebase it out after merge; Android runtime claims remain gated in that PR.

[besmpl]

Stacked consumer preview: #268 at exact head b11d2671e80081a191705c41c4e77e8b61472017 incorporates this PR's head a8ff52e340f0a06c8e1b6599a03856d7fc74d1a2; overlapping swapchain changes are conflict-resolved against the Android-specific policy layer.

The preview remains explicitly draft/non-mergeable and will be rebased to Android-only commits after this prerequisite lands.