Release completion-proven draw resources during teardown

## Observed cleanup defect

At main `fef8f423`, `DrawRetirements::drop` quarantines all pending payloads,
including draws whose exact completion generation is already signaled. If a
Scene is destroyed after its final callback but before another retirement poll,
the completed source/map/context owners are retained for process life. Repeated
Scene/GPU tests can therefore keep devices alive past their expected scopes.

Release only completion-proven entries during teardown without driving or
waiting for the device. Preserve quarantine for unresolved work, stale
generations and terminal poll/encode failures. Quarantine unresolved owners
before any completed payload destructor can run, including a panicking one.

## Safety incident and verification limit

The owner reported a frozen desktop requiring a hard reset during a broad
real-GPU workspace gate on September 13. Previous-boot kernel logs show AMD
"Not enough memory for command submission!" errors immediately before the
desktop teardown. The gate did not complete. This cleanup defect is statically
identified; its contribution to the freeze is not established. Do not close
the incident or claim a desktop fix from CPU unit tests.

GPU/playback/stress/UI/SDK work is stopped pending owner approval. Initial
verification is limited to deterministic CPU-only ownership regressions under
explicit CPU/memory bounds. The installed signed Flatpak remains unchanged.
Performance experiment #186 is parked; its candidate is not merged or installed.

Start at DrawRetirements::drop, the cleanup point named in the issue, and trace how pending payloads are classified during teardown. Verify that completion-proven entries are released without driving or waiting, while unresolved, stale, and terminal-failure entries remain quarantined; use deterministic CPU-only ownership regressions under explicit CPU and memory bounds.

由索引模型根據 Issue 內容生成。