fix: reject image results after Metal backend failures

[leehack]

A failed Metal command buffer can leave upstream generate_image returning a corrupt image as success. The guarded sd_dart_generate_image export now detects the pinned Metal failure/error-state diagnostics (including INFO level), frees returned batches, clears outputs, and rejects tracked-context reuse until disposal/reload. No upstream source or ABI/export change. Synthetic failure logging occurs outside the context registry lock so recorder waits do not hold up cancellation/disposal.

Validation:

• Controlled native success/failure and batch-cleanup tests, including muted logs, threaded reporting, nullable count, ring pressure, stale state, fresh-context recovery and ordinary error/abort negative controls; plain/ASan/TSan pass.
• macOS-arm64 release build and artifact export/dependency validation pass.
• Healthy existing SD Turbo Q4_0, 256x256, one step: guarded CPU and explicit MTL0 Apple M4 Max pass. Physical iPhone16Pro/A18Pro failure reproduction unavailable; this does not prove watchdog prevention (#1047).
• Full native suite on the reviewed head: 53 tests, PASS, 7 skips.
• Independent exact-head/current-base blocking QA on 1bb395f vs 16df759: zero known PR-caused P1/P2 findings. Hosted CI: automatic PR run passed all 17 checks on 1bb395f7540cc35570c307a30f354f267de43a6d.

Closes #19. Kept separate from upstream update/FP8 work in #20. Source only: artifact release, Apple companion checksum/pin adoption and downstream qualification require separate approval. Publication and consumer changes remain separate from this source merge.

High-risk QA

• Independent exact-head/current-base blocking review: zero known PR-caused P1/P2 findings.
• Final GitHub review audit: zero comments, zero submitted reviews, zero unresolved review threads.
• Automatic hosted CI passed on the exact pushed head; no manual reruns or workflow dispatches.
• Source merge only; publication and downstream pin updates remain separate.

Post-merge verification: merged as ea609150a6a55746a2b98ddc7955b60e07867cce; merged tree exactly matches the tested source head. Automatic main CI passed all 17 checks. Publication and downstream artifact/checksum/pin adoption remain separate.