feat(gl): OpenGL 4.1 and the ludic.render3d renderer

`Gl.*` binds the whole OpenGL 4.1 core API — every entry point of the
platform gl3.h with every GL_* constant, generated by `ludic-dev glgen`
with per-call ABI thunks. Windowed builds get an NSOpenGLContext on the
existing window at Retina resolution; headless builds render into an
offscreen CGL context, so a program that uses Gl.* renders and
screenshots identically under the test harness. It links gl.ll, the
thunks and OpenGL.framework only when used; every other build stays
byte-identical.

packages/ludic.render3d is a physically based renderer written on that
surface: HDRI image-based lighting, GPU-generated terrain with scanned
PBR materials, CDLOD, cascaded shadows, glTF with skinning, instanced
vegetation with impostors, procedural grass, water, SSAO, and an HDR
pipeline with bloom, auto-exposure and ACES.

It also carries this session's work on it: the terrain at half its cost
(10.3 -> 5.4 ms of frame), the streaming hitch that got worse the longer
you played, a resize that emptied the world, and the packaging that lets
a game use the renderer from its own repository — `ludic assets`, the
material manifest shipping with the package, and shader lookup falling
back to the install root. See changes/ for each, with its numbers.

The camping game that drove all of it has moved out to its own
repository, Maroon Lake; examples/rendering/smooth.ludic stays as the
renderer's example here.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

changes/resize-depth-fix.md

@@ -0,0 +1,27 @@
+bump: patch
+type: fix
+**Resizing the window (or entering fullscreen) no longer empties the world.** It left
+`gl error 1286` — `GL_INVALID_FRAMEBUFFER_OPERATION` — on every frame from there on, with
+the terrain, the trees, the grass and the water gone and only the sky drawn.
+
+The sun-visibility pass added in `changes/terrain-perf.md` borrows the depth buffer the
+frame is about to be drawn with, so that rasterising it doubles as a depth prepass. It
+was storing that borrowed texture in its `Target`, and a `Target` deletes whatever its
+`depth` names when it is freed. On the first resize the sequence was: `post_free` deletes
+the frame's depth texture, `post_init` immediately makes the replacement — and GL hands
+back the name that was just freed — and then the visibility target, rebuilt for the new
+size, deleted that name believing it was its own. The scene framebuffer lost its depth
+attachment. What is left is a colour-only framebuffer, which is *complete*, so drawing
+carried on with no depth test at all: the sky is a fullscreen quad drawn last, and with
+nothing left to fail against it painted over the entire valley. The 1286s came from the
+passes whose own attachment now named a texture that no longer existed.
+
+A borrowed attachment is never written into the target now, and the frame's depth is
+attached afresh at the start of each pass — it is a different texture every time the
+screen-sized buffers are rebuilt, and one `glFramebufferTexture2D` per pass is cheaper
+than any scheme for noticing that it changed.
+
+`R3D_RESIZE_AT=<frame>` rebuilds every screen-sized buffer from that frame on, cycling
+through four drawable sizes every few frames. A window cannot be resized in a headless
+run, so this is the only way to reach the path; it reproduced the fault in one frame and
+now runs twenty resizes, with the fly camera and with the game, without an error.