Add off-main-thread SDL dispatch

[jserv]

macOS requires SDL window and event-pump calls on thread that created the windows (the first XOpenDisplay caller); an Xlib entry point that touches SDL from a client worker thread crashes there.

Add runOnMainThread: it runs the work inline when already on the main event thread, otherwise posts an SDL_USEREVENT and blocks until the main thread runs it. The event-pipe wake is load-bearing here; SDL3's native SDL_RunOnMainThread does not wake a main thread blocked in SDL_WaitEvent, so it is not adopted, only left as a documented delegation seam.

Rework the XInitThreads display lock (src/display.c) from a plain recursive mutex into a handoff-aware recursive monitor. A worker that hands SDL work to the main thread sheds the lock while it blocks and reacquires after; while a handoff is pending only the main thread (to run the work) and the shedding worker (to reacquire) may take the freed lock, so no third thread interleaves the worker's XLockDisplay critical section. The gate is folded into ownership under the monitor mutex, so there is no check-then-act race. A single atomic mainEventThreadId is the main-thread-ownership predicate.

Route the SDL-touching window entry points through the dispatch when called off the main thread: X{Map,Unmap,Raise}Window, XStoreName, XIconifyWindow, XConfigureWindow / XMoveWindow / XResizeWindow (via configureWindowRouted, with XMoveResizeWindow now one atomic configure), XReparentWindow, and XMap/XUnmapSubwindows. requireMainEventThread aborts at the SDL sources if a routed body ever reaches a worker thread instead of crashing silently off-main.

convertEvent runs on whatever thread drained the SDL queue, so the MAIN_DISPATCH branch re-queues the event (or drops the command to unblock the worker if the re-queue fails) when a non-main thread drained it, rather than running the thunk off-main. mainDispatchHandleEvent defers a non-handoff-owner thunk while a handoff is pending so it does not interleave the owner.

---

Summary by cubic

Adds synchronous off-main-thread dispatch so all SDL window and event calls run on the main event thread to prevent macOS crashes. Also adds an SDL2 SDL_PollEvent shim and test hardening.

• New Features

  • runOnMainThread + MAIN_DISPATCH_EVENT_CODE: post an SDL_USEREVENT and block; runs inline on main and wakes the loop.
  • Handoff-aware display lock: displayLockReleaseForHandoff, displayLockHandoffPending, displayLockReacquire.
  • Route off-main SDL-touching Xlib ops via dispatcher: X{Map,Unmap,Raise}Window, XStoreName, XIconifyWindow, X{Configure,Move,Resize,MoveResize}Window (atomic), XReparentWindow, XMapSubwindows, XUnmapSubwindows, XDestroyWindow, XDestroySubwindows.
  • WM/state appliers self-route with runWindowOpOnMain: Motif hints, _NET_WM_STATE, resizable, icon, borderless, transient/modal; XSetWMNormalHints tail routed; XCloseDisplay teardown (destroyScreenWindow) runs on main.

• Bug Fixes

  • Defer non-owner dispatch while a handoff is pending; re-queue/flush via mainDispatchRunDeferred. convertEvent re-queues when drained off-main to avoid running thunks on a worker.
  • Guard SDL sites with requireMainEventThread; compatUnlockDisplay checks owner and positive depth.
  • Add SDL2 shim SDL_PollEvent over SDL_PumpEvents/SDL_PeepEvents to preserve side-queue semantics and fix SDL2 link failures.
  • Tests: add off-thread routing coverage; prevent hangs by pumping/draining until dispatches run and the ClientMessage arrives; fix ThreadSanitizer race in off-thread XCloseDisplay by servicing only the routed destroyScreenWindow then joining.

^{Written for commit 6544cde. Summary will update on new commits.}