Fix the native items from the review

[SimonCropp]

This fixes the "Native" group from todo.md, apart from App Nap, which needs a Mac to check. The binaries are rebuilt by build-native (#892, fast-forwarded into this branch).

Item	Fix	Tests
Decoded image caches never evict on Linux or macOS	Linux marks each picture a frame asks for and drops the rest after rendering (ForgetUnusedPictures). macOS keeps only the paths the frame names	None; the cache is not visible from outside
macOS drag-select clamps to capacity rather than the rows drawn	draggedRow clamps to the pane's rows, as Linux's RowAt does	Needs a Mac
The Linux queue header ignores pendingCount	Pending (N)###Pending, so the column id does not change with the count	The six Linux pixel baselines with a queue, re-approved; the header is the only change in each
deview_capture flips scissors with the window height	drawData->DisplaySize.y	Latent; captures are the window's size
Five-digit line numbers widen the Linux gutter	One digit count for every row of a frame (GutterDigits, at least four), so the text start read from the first row holds for all	Output is unchanged below line 10000
No autorelease pool around the hand-pumped frame	Every export's body runs in autoreleasepool	Needs a Mac
Dock Quit and logout skip PersistOwned	An app delegate records a close and returns .terminateCancel; the managed loop exits and persists as it does for the close button	Needs a Mac
NativeResolver loads the glibc build on musl	A musl RID probes itself and nothing else, as BundledViewerDirectory.Rids does	NativeTests.MuslProbesItsOwnRidAndNothingElse, OtherRidsStillFallBackToTheSynthesisedRid

The Linux pixel tests compare at SSIM 0.999, which the header's extra characters stay above, so the old baselines still passed. They were recaptured on CI rather than left describing the old header. The other four came back byte-identical, so the gutter and scissor changes leave ordinary output alone.

This also fixes the windows job, red on main since #890. FormsHeadTests.CanvasHost docked its canvas to a form, and a top-level window is held to the screen's size: on the 1024×768 agent every canvas came out 1028×749, so HighlightAtColumn66CoversItsGlyph drew no column 66 and WhatTheFirstWindowHoldsAtEachScale measured a 200% window at 1028 wide. The canvas is now sized itself, as a child control that no screen limits.

A refused quit also cancels a logout that asked for it, as with GLFW apps; the viewer has exited by the time the logout is tried again.

The full solution passes locally in Release: 2,090 passed, 22 skipped.