Add immutable Metal Gaussian attribute residency

[snkmcb]

Summary

Metal Gaussian compute tests previously uploaded every source attribute on each frame. Add a backend-private resident attribute store and bind its immutable buffers in the prepare/sort/gather/indirect-raster harness. Static, camera, transform and visibility changes reuse buffers; edits with a matching base revision stage only the affected particle ranges, copying old attribute versions on the GPU before patching them.

Updates publish transactionally after submission. Completion handlers retain staging and previous versions, and a live-byte budget includes unfinished submissions. Source changes, resource generations, revision gaps and count/SH layout changes reconcile safely.

Impact

• Affects Metal, its compute/image tests, CMake test registration and documentation.
• No public API or GPU-mode support change: renderer integration and telemetry remain open; Metal prefer still falls back and require rejects.
• Partial edits currently copy the full affected attribute on the GPU. This establishes correctness and transfer-volume behavior, not an interactive performance improvement.
• Updates the execution design, support matrix, current roadmap and Unreleased changelog.

Verification

Apple M3, macOS 15.7.9, with Metal API and shader validation enabled:

cmake --build build-metal --parallel 4
ctest --test-dir build-metal --output-on-failure
Result: 25/25 passed, no skips.

cmake --build build/metal-compute-release --parallel 4
ctest --test-dir build/metal-compute-release --output-on-failure
Result: 25/25 passed, no skips.

After extending the in-flight budget assertion, the Debug residency test was rebuilt and rerun successfully; the Release full run includes that assertion. Final builds pass in both configurations. Existing SDK warnings remain.

• The continuous three-particle image sequence stages 156 bytes initially, zero on static/camera/transform/visibility frames, and 28 bytes for one particle's opacity/covariance edit. Color differs by at most 2/255 per channel; depth and resource/particle IDs match exactly.
• Independent byte checks cover disjoint ranges, degree-3 SH updates, count/layout changes, source/handle identity, removals, invalid/abandoned/stale plans and budget rollback.
• Two event-blocked GPU submissions verify old/new versions and allocation accounting after dropping CPU plans and resetting residency.
• ABI, Vulkan SPIR-V compilation, artifact identity and install-consumer checks pass.
• Vulkan runtime and native viewport/HgiMetal were not exercised locally. The separately dispatched GPU capability workflow covers Windows Vulkan/Hydra; it does not establish Metal runtime coverage.

CI runs for this PR:

• Core / Metal / MaterialX CI
• Windows Vulkan / Hydra GPU capability CI

Review checklist

• The change follows the contribution guidelines.
• Observable behavior has tests.
• Changes are recorded under Unreleased.
• Support claims and command examples match validated behavior.