feat(vulkan): qualify surface adapters with present queues

[besmpl]

Summary

Qualify Vulkan adapters against the requested surface before opening a device:

• query every queue family with checked vkGetPhysicalDeviceSurfaceSupportKHR results
• initially require one queue family that supports both graphics and presentation
• query and validate the surface capability/format/present-mode snapshot, preserving exact Vulkan format/color-space pairs
• return a request-local adapter wrapper carrying the selected queue family into Open
• keep cached surface-independent adapters immutable
• serialize surface-aware requests around one-shot deferred GLES enumeration
• release unselected request-local adapters immediately and release the selected ID with its public adapter, bounding repeated surface/window requests and selection failures

This follows the Rust wgpu shape: adapter selection for a compatible surface proves the presentation queue that device creation will actually use.

Why

The previous path could enumerate an adapter without proving surface support, then open queue family zero (or another graphics-only family). Capability-query failures could also collapse into an apparently usable adapter.

Request-local wrappers must have request-local lifetime as well; otherwise repeated surface replacement, multi-GPU selection, and failed fallback selection retain qualified adapter and surface state until the whole instance is destroyed. Serializing the snapshot with deferred GLES enumeration also prevents concurrent requests from misclassifying another request's surface-bound adapter as their own.

Validation

Go 1.25.12 and Go 1.26.5:

• go test ./core ./hal/vulkan .
• go test -race ./core ./hal/vulkan .
• go vet ./core ./hal/vulkan .
• current golangci-lint v2: zero issues introduced relative to upstream/main

Failure-injection tests cover split queues, failed Vulkan queries, request-local ownership and cleanup, selection errors, repeated requests, and cached-adapter immutability.

Split graphics/present queues remain deliberately unsupported in this first correction.

Android preview relationship

This Android-independent prerequisite is stacked into draft #268 at exact head a3e839f94a12edce98e2496d96e5bd8d3cdd2fc3. The draft will rebase it out after merge; Android runtime claims remain gated in that PR.

[besmpl]

Stacked consumer preview: #268 at exact head b11d2671e80081a191705c41c4e77e8b61472017 incorporates this PR's head a3e839f94a12edce98e2496d96e5bd8d3cdd2fc3. The latest request-lifetime commit has a matching stable patch ID; earlier Vulkan overlap is conflict-resolved against Android-specific surface hardening.

The preview remains explicitly draft/non-mergeable and will be rebased to Android-only commits after this prerequisite lands.