[Perf] (MG_Backend): let DirectVulkan trust across frames what it proved once

The draw fast path still paid for its own proofs: the hottest single
load (20% of TrySetupDrawFastPath) was chasing the cold
VertexInputStateFactory heap entry just to answer "same vertex-input
layout?". That answer now comes from the frontend VAO's config-guarded
aux memo (layout hash + attribute masks), and a VAO-cycling stream with
a stable layout skips the pre-flight AND pipeline re-resolution
entirely. The VkProgramObject* is memoized on the snapshot behind a new
ProgramFactory cache-structure epoch (bumped on every insert/erase; use
is re-stamped so the idle sweep can never evict a live entry). A
render-state version move no longer forces the full path: the pipeline
value hash is refreshed in place and the 8-entry memo probed directly
(the GL_BLEND-toggle case).

The resolved-vertex-bindings memo now revalidates all-resident unmapped
entries ACROSS frames via per-binding slice epochs - minted from a
process-lifetime counter so a recycled address can never revalidate,
with every mutation path funnelled through BumpSliceEpoch - while
stamping each resource's GPU-use serial exactly as the skipped acquire
would, preserving the busy-tracking that glBufferSubData's
host-write-vs-staged-copy choice depends on. Resident index buffers get
the same treatment through an EBO slice memo.

The six-part dynamic-state tail (viewport/scissor/blend constants/depth
bias/line width/stencil) is gated behind one render-state-parameters
version + pass-geometry compare per command buffer. GetSlice is inlined;
SampledBindingsUnchanged walks only the program's declared bindings.

Quiet-box 6-round order-alternating A/B (on top of the frontend
VAO-bind commit): vanilla_draw -20.8% (790 -> 626 ns/op, 3.4x native to
2.5x), sampler_churn -28.2%, ubo_range -8.4%, state_toggle -3.8%;
tex_param's matrix flag (+10%) was adjudicated by an isolated
alternating re-run at +1.0% - position bias, not regression. Unit tests
421/421.

MobileGL/MG_Backend/DirectVulkan/Renderer/ProgramFactory.h

@@ -105,8 +105,9 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             // position-invariance quirk (see PipelineFactory::ShouldSuppressDepthWrite).
             Bool fragmentReplacesDepth = false;
             // Frame-boundary counter value of the last GetOrCreateProgram hit; drives
-            // cache eviction (see OnFrameBoundary).
-            Uint64 lastUsedFrame = 0;
+            // cache eviction (see OnFrameBoundary). Mutable: the draw snapshot's memoised
+            // entry pointer re-stamps use through a const reference (StampProgramUse).
+            mutable Uint64 lastUsedFrame = 0;
 
             static inline VkDevice s_device = VK_NULL_HANDLE;
 
@@ -262,6 +263,16 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         const VkProgramObject& GetOrCreateProgram(
             const MG_State::GLState::ProgramObject& program, CompileOptionFlags flags);
 
+        // Bumped whenever m_cache's STRUCTURE changes (any insert or erase): the cache is
+        // an open-addressing map holding entries by value, so both moves existing entries.
+        // A caller that memoised a VkProgramObject* may keep dereferencing it only while
+        // this is unchanged; on a bump it must re-run GetOrCreateProgram.
+        Uint64 GetCacheStructureEpoch() const { return m_cacheStructureEpoch; }
+        // A memoised entry pointer bypasses GetOrCreateProgram, whose per-lookup stamp is
+        // what keeps an in-use entry out of OnFrameBoundary's idle sweep - so such a
+        // caller must re-stamp the entry itself, at least once per frame boundary.
+        void StampProgramUse(const VkProgramObject& entry) const { entry.lastUsedFrame = m_frameCounter; }
+
         // Observer may be null (no notifications). Not owned.
         void SetEvictionObserver(IEvictionObserver* observer) { m_evictionObserver = observer; }
         // Frame boundary hook: ages the program cache and evicts long-unused entries
@@ -312,6 +323,8 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         mutable ProgramLookupCache m_lastLookup;
         // Monotonic frame-boundary counter (bumped in OnFrameBoundary) for cache aging.
         Uint64 m_frameCounter = 0;
+        // See GetCacheStructureEpoch(). Starts at 1 so a zero-initialized memo can never match.
+        Uint64 m_cacheStructureEpoch = 1;
         IEvictionObserver* m_evictionObserver = nullptr;
         static inline XXH64_state_t* m_hashState = XXH64_createState();
     };