[L-Sun]

Engine::TickFrame currently imports Metal solely to manage a macOS autorelease pool. Move that native lifetime into MetalDevice::BeginFrame/EndFrame so Engine only coordinates the platform-independent frame lifecycle.

Keep BeginFrame in the existing GraphicsFrameSystem schedule. Add a non-throwing EndFrame hook and invoke it from Engine's RAII frame guard after the full frame, including schedule-preparation failures, task exceptions, and synchronous SDL live-resize callbacks. Metal drains only the current frame pool, rejects overlapping begins, and leaves enclosing Cocoa and device fallback pools intact. Other backends inherit an empty EndFrame; it does not wait for GPU completion.

Regression coverage verifies temporary-reference reclamation, enclosing-pool preservation, exceptional Engine frames and subsequent recovery through the SDL modal callback path, and submitted Metal recordings surviving frame-pool teardown while GPU execution is gated. Document the host pairing contract and the separate responsibility for initialization, frame-external work, and worker threads.

Validation on macOS ARM64 (Apple M5), debug with profiling enabled:

• xmake build -j 4 unit_tests passed.
• 38 tests passed across MetalDeviceTest, GraphicsFrameTest, MetalCommandTest, MetalQueueTest, RuntimeScheduleTest, and AppTest.
• xmake lua xmake/scripts/check_interop.lua: 216 consumer/adapter files and 27 boundary files, zero violations.
• git diff --check passed.

Windows compilation is left to CI. SDL modal-frame tests use synchronous exposed events rather than manual window dragging.