[Fix] (MG_Backend/DirectVulkan, MG_State): key per-object memos on lifetime ids, not heap addresses

A destroyed VertexArrayObject's heap address is handed straight back by the
next allocation of its size, and so is a destroyed BufferObject's. DirectVulkan
keyed its per-VAO draw memo on the VAO POINTER and folded the bound buffer's
ADDRESS into the content hash that validates the memoised bindings, so a
delete/recreate pair under a byte-identical attribute layout reproduced both
the key and its validating hash at once. The successor VAO then inherited the
dead one's resolved bindings and the draw fetched from a destroyed VkBuffer.
Both stated defences failed together, because both reduce to the content hash
and the hash's buffer-identity component was itself a recycled address.

VertexArrayObject and BufferObject now carry a globally-unique, never-reused
GetLifetimeId() - the same contract as ProgramObject's, minted from an atomic
starting at 1 so a zero-initialised slot can never name a live object.
VaoDrawMemo matches on (address, lifetime id) and stores the id on recycle,
SetupDrawSnapshot's "the VAO did not move" test compares the id alongside the
config version, and VertexInputStateFactory::ComputeHash hashes the bound
buffer's id instead of its pointer (0 for client memory).

Proven: the use-after-free reproduces at 100% incidence headless on lavapipe,
including a SEGV whose backtrace is the driver dereferencing a destroyed vertex
buffer inside lvp_queue_submit, and it is gone with the fix. New coverage -
MG_Test/State/ObjectLifetimeIdTest (deterministic, GPU-free, no context: it
waits for the real allocator to repeat an address and asserts the id differs,
and skips loudly rather than passing quietly if it never gets the chance), and
MG_IntegrationTest XfbAfterClipDistanceScenario, registered for DirectGLES,
DirectVulkan, and a third DirectVulkan run with async shader compilation pinned
on because that is a second allocation pattern. Gates: 553/553 unit green at
async=0 and async=1; the scenario 5/5 headless at both flag states; 71/72 CI
trace-replay fixtures over both backends, the one failure a pre-existing
lavapipe crash proven not a regression (identical SIGSEGV at the identical
call number under the pre-fix library).

Pending NVIDIA/X11 confirmation: the KHR-GL{32,40} transform_feedback failures
that opened this investigation never reproduced on lavapipe - the -2/-101
pre-fill signature appears in zero pre-fix runs there - so whether this clears
them is UNPROVEN and must be re-measured on the NVIDIA rig against a freshly
re-run pre-fix baseline. The residual suspect is deliberately untouched here:
m_xfbCounterSlotByObject keys its counter slot on the raw GL transform-feedback
name, so a recycled name whose generation check happens to pass would RESUME
instead of BEGIN. That path was never exercised on lavapipe and is neither
confirmed nor exonerated.

MobileGL/MG_Backend/DirectVulkan/Renderer/VulkanRenderer.h

@@ -758,6 +758,12 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             Uint64 programLifetimeId = 0;
             Uint32 programVersion = 0;
             const void* vao = nullptr;
+            // Same rule as VaoDrawMemo::vaoLifetimeId: (address, config version) is not an
+            // identity, because a recycled address can arrive carrying a config version
+            // the dead VAO also had (two mutations to configure one attribute is the
+            // common shape), and "the VAO did not move" would then skip the layout
+            // re-resolve for a different VAO.
+            Uint64 vaoLifetimeId = 0;
             Uint32 vaoConfigVersion = 0;
             const void* drawFbo = nullptr;
             Uint16 fboVersion = 0;
@@ -987,19 +993,30 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             const MG_State::GLState::BufferObject* buffers[kMaxBindings] = {};
             Uint64 sliceEpochs[kMaxBindings] = {};
         };
-        // One direct-mapped slot of the per-VAO draw-memo table below. The key is a
-        // lookup hint only - a slot is never dereferenced through vaoKey; every fact it
-        // carries is validated against live state before use:
+        // One direct-mapped slot of the per-VAO draw-memo table below. A slot belongs to
+        // the object whose (vaoKey, vaoLifetimeId) pair it carries: the address alone
+        // only picks the slot, and the never-reused lifetime id is what proves the slot
+        // is THIS VAO's, so the successor allocated onto a destroyed VAO's address
+        // always misses. That identity check is load-bearing and the content-hash
+        // validations below do NOT stand in for it - a recycled address under a
+        // byte-identical configuration reproduces the content hash exactly, which is
+        // how a destroyed VAO's resolved bindings were once handed to its successor's
+        // draw. The slot is still never dereferenced through vaoKey, and every fact it
+        // carries is still validated against live state before use:
         //  - layoutHash/layoutAuxMasks are valid only while contentHash equals the LIVE
         //    VAO's own hash memo (which the VAO's config version guards), so a config
-        //    change, a buffer rebind, or a recycled VAO address with a different
-        //    configuration all miss. A recycled address with a byte-identical
-        //    configuration AND identical bound buffers reproduces the content hash, and
-        //    then the facts are correct by construction (they are a pure function of it).
+        //    change or a buffer rebind misses even for the same object.
         //  - bindings revalidates per draw exactly as before (frame serial, content
         //    hash, per-binding live buffer pointers and slice epochs).
         struct alignas(64) VaoDrawMemo {
             const MG_State::GLState::VertexArrayObject* vaoKey = nullptr;
+            // The VAO's never-reused lifetime id, checked alongside vaoKey. The pointer
+            // ALONE is not an identity: a deleted VAO's heap address is handed straight
+            // back by the next glGenVertexArrays-shaped allocation, and the successor then
+            // matched this slot and inherited the dead object's memos. Both stated
+            // defences failed with it, because both reduce to the content hash and the
+            // content hash's buffer-identity component was itself a recycled heap address.
+            Uint64 vaoLifetimeId = 0;
             // The VAO content hash (VertexInputStateFactory::GetOrComputeHash) the two
             // layout facts below were derived from; 0 while nothing valid is stored.
             Uint64 contentHash = 0;