Move the Metal renderer and CoreVideo surfaces onto objc2-metal and objc2-core-video

[chris-addison]

Moves gpui's macOS code off the legacy objc 0.2, block 0.1, metal 0.33 and core-video 0.5 crates onto objc2-metal and objc2-core-video 0.3.2. Both were already in the lockfile, so this adds no crates and changes no versions. block 0.1.6 is what triggered rustc's "code that will be rejected by a future version of Rust" warning.

Removed from the tree: block, objc, malloc_buf, metal, core-video, core-graphics2, io-surface, cgl, leak, leaky-cow. cargo tree --workspace -e all --target all -i <crate> finds none of them.

Scope

• Our own legacy code was small: one block::ConcreteBlock in metal_renderer.rs and one use objc::* in the gpui_media bindings. gpui_macos already used objc2::msg_send! throughout.
• block and objc only left the tree once metal and core-video were replaced too: metal 0.33 depends on both, and core-video 0.5.2 depends on block even without its metal feature.
• Public API (macOS only), required to drop core-video and metal:
  • SurfaceSource::Surface carries CFRetained<objc2_core_video::CVPixelBuffer>.
  • ScreenCaptureFrame.0 is CFRetained<CVImageBuffer>.
  • MetalRenderer::layer() and layer_ptr() return objc2's CAMetalLayer.
  • media::core_media and media::core_video take and return objc2 types.
• Retain semantics are preserved. Results from create/new calls are taken as owned, and getter results are retained.
• Allocation failures now fail loudly. A Metal call that can fail (buffer, texture, queue, sampler, encoder) panics with a clear message instead of carrying a null pointer. The exceptions return an error: render_scene_to_image when the blit encoder can't be created, and draw_primitives_to_texture on a command-buffer failure.
• Buffers crossing threads. Instance buffers returned from Metal's completion thread are wrapped in PooledBuffer (unsafe impl Send), with the justification next to it. The old metal crate made the same claim for its buffer type.
• gpui_macos no longer depends on gpui_media: screen capture reads the image buffer through objc2-core-media.

Verification

• cargo clippy --locked --workspace --all-targets -- -D warnings passes on macOS, and the future-incompatibility warning is gone.
• cargo test passes for gpui-ce (356), gpui_ce_apple (13, including the 9 headless Metal pixel checks for quads, borders, shadows, blur, sprites and paths), gpui_ce_macos (13) and gpui_ce_wgpu (42).
• The hello_world and blur examples open on-screen windows and run cleanly. No visual capture: the session had no Screen Recording permission.
• cargo fmt --all -- --check is clean.
• Already failing on the base commit 79ace671, unchanged by this PR:
  • redundant_clone in gpui_macos/src/screen_capture.rs when the screen-capture feature is on;
  • the bench-support feature doesn't compile.

🤖 Generated with Claude Code