[MG_Backend, MG_Test] (Disaggregated): P5e wave 2 integration - the three seams where two packages met

- vi and sb both added a block at the same point of DirectGLES.cpp's buffer
  section; both belong, and vi's arm used to borrow the `#endif` that follows the
  hunk, so it gets one of its own and sb's block opens below it.
- pg and sb both rewrote the UBO loop's first lines: pg changed where `binding`
  comes from (the archived block-binding tail, because glUniformBlockBinding moves
  it after the link), sb changed what `binding` indexes (the applier's window
  instead of the frontend binding-point array). The merge keeps pg's source and
  sb's consumer, which is the boundary both reports named.
- pg wrote a comment stating the shape of the texture memo key because the line
  belongs to tx2; tx2 wrote the fields. Both kept.
- PipeCatalogue's routed-row pin read 38 at the base, and sb (one generated row)
  and pg (one escape) each landed 39 against it. The merged tree has 40, which is
  what the count now asserts, with both rows named in the comment.
- Gates on the merged tree: unit 2250/2250, integration-split 113/113, gen_pipe
  and gen_pipe_field_ownership --check/--self-test green, include closure 4 probes
  0 problems, dirty surface --check/--self-test green, doc citations one
  pre-existing CONTRACT-P5.md ambiguity. Strict is still the phase's two-sided
  lane; its first-blocker markers fell from {GetTextureUnitObject@Clear 13,
  GetFramebufferBindingSlot@Clear 6, GetTextureUnitObject@GenerateMipmap 2} to
  {GetFramebufferBindingSlot@Clear 2, GetProgramForDraw@DrawArrays 1} plus the
  allowlisted barriered rows (ReadPixels, CopyTexImage2D) that were always behind
  them. Run-ahead is still OFF: kMGPipeP5eRunAheadReady and
  kMGPipeP5eClientWaitRuleLanded are both false, so this is the lockstep split
  with every family reading records instead of the frontend.

MobileGL/MG_Test/Pipe/PipeCatalogueTest.cpp

@@ -243,18 +243,20 @@ TEST(PipeCatalogue, ExactlyTheRoutedRowsAreInstalledAndTheRestAreStillNull) {
     EXPECT_EQ(installed + nulls, static_cast<SizeT>(kMGPipeCallCount));
 
 #if MOBILEGL_PIPE_PUSH
-    // 35 + 4 = 39, and the split is the honest shape of R-17 rather than an implementation
-    // detail: 39 is the number of MGPipeApply* entry points PipeApply.h declares WITH A BODY
-    // (37 at P5, P5c rv's set_context_values was the 38th, and P5e sb's set_shader_buffers is
-    // the 39th), 35 of them fit a GENERATED row and go in the two tables, and FOUR cannot be
+    // 35 + 5 = 40, and the split is the honest shape of R-17 rather than an implementation
+    // detail: 40 is the number of MGPipeApply* entry points PipeApply.h declares WITH A BODY
+    // (37 at P5, P5c rv's set_context_values was the 38th, P5e sb's set_shader_buffers is the
+    // 39th and P5e pg's set_program_bindings the 40th - the two landed in parallel packages,
+    // each of which read 38 as its base and wrote 39; this is the merge saying so), 35 of them
+    // fit a GENERATED row and go in the two tables, and FIVE cannot be
     // expressed by any generated signature and go in the hand-written escape table beside them
     // (ResourceRespecify's uncarried initialBytes, ResourceFlushRange's likewise,
     // MapPersistent's size + seedBytes + void* return, CreateShaderState's seven blobrefs and
     // two typed pointers - each one a CONTRACT-P5 ruling, see MG_Pipe/PipeRoute.h).
     //
-    // set_program_bindings (opcode 80) is DECLARED and still aborting by name until package pg
-    // writes its body, so it is not counted here and its row is pinned null below - which is
-    // the same statement this pair of numbers has always made about an unimplemented row.
+    // set_program_bindings (opcode 80) HAS its body since package pg, and it is the fifth
+    // escape rather than a generated row; its `gMGPipeContext` slot therefore stays null and is
+    // pinned null below, which is what an escaped row looks like here.
     //
     // BOTH NUMBERS ARE ASSERTED. If the escape table were left out of this case, moving a row
     // out of the generated tables and forgetting to install its escape would read as a smaller
@@ -270,10 +272,10 @@ TEST(PipeCatalogue, ExactlyTheRoutedRowsAreInstalledAndTheRestAreStillNull) {
     // plus a parallel name array, which no generated (payload, varTail, varTailCount) row can
     // express - so opcode 80's `gMGPipeContext` slot stays null (pinned below, unchanged) and
     // its adapter lives in the escape table beside create_shader_state's. The applier's entry
-    // points are 39 with it.
+    // points are 40 with it and with sb's generated row.
     EXPECT_EQ(escapesInstalled, 5u) << "an escape row is null; its call site would take a null "
                                        "pointer rather than fall back to anything";
-    EXPECT_EQ(installed + escapesInstalled, 39u)
+    EXPECT_EQ(installed + escapesInstalled, 40u)
         << "the two tables plus the escapes must be exactly PipeApply.h's bodied entry points";
 
     // And the rows that MUST still be null, named rather than counted: these are calls with no