Release j2k 0.7.1 with safe Metal resident ownership

[jcwal1516]

What changed

• stages the 0.7.1 accelerated codec release candidate
• adds opaque ResidentMetalImage ownership with validated layouts and device identity
• retains Metal inputs and outputs through command completion with SubmittedMetalImages
• adds safe resident JPEG and J2K encoder entry points while keeping raw interop unsafe
• updates stable API, semver review, unsafe-audit, and release-gate evidence
• classifies the interactive Metal capture test separately from the unattended release inventory

Why

The previous Metal handoff exposed raw buffers without expressing immutable ownership or the lifetime of in-flight GPU work. The resident image boundary keeps the buffer private, validates range and device invariants, and makes resource retention part of the submission owner.

Impact

Downstream Metal users can pass decoded images directly into encoders without a copy or readback. Audited external producers can still adopt and access raw buffers through documented unsafe APIs. ResidentPrivateJpegTile::into_buffer is now unsafe; the safe replacement is into_resident_image.

Validation

• cargo xtask ci
• cargo xtask release-cpu
• cargo xtask release-metal
• cargo xtask stable-api
• CARGO_NET_OFFLINE=true cargo xtask semver
• cargo xtask release-integrity
• cargo xtask package
• gitleaks 8.30.1 worktree and 1,327-commit history scans

CUDA hardware validation is intentionally pending on the repository's self-hosted runner and must pass for this exact SHA before merge or tag publication.