Engine sync to latest Servo, plus the corner and Meta-key fixes

[Goddv]

Four things: the corner bug from #4, a sync onto the freshly-synced engine, one
input fix that came with it, and then the features that sync actually unlocked.

1. Corners — closes the real half of #4

The glow blend was shared across platforms and is already on main
(7f1859b): chrome_fill_at combined the lit band with theme::mix, which
returns an opaque colour, from two colours already premultiplied down by the
tint — so it produced an opaque colour whose RGB had been scaled by an alpha it
then discarded. Pure epaint arithmetic, no platform in it, which is why "turn
the glow off" helped on both macOS and Windows.

The corner technique was not shared and was applied as though it were.
Cutting a corner out of the framebuffer and painting the chrome back over the
hole matches perfectly — but an erased pixel is only a hole where the window
composites with alpha and something sits behind it. On macOS that is the
NSVisualEffectView; elsewhere the window is opaque and destination-out takes
the colour with it, leaving black. The erase was never gated, so it had been
running on Windows and Linux all along.

pub enum Corners {
    AlreadyRounded, // an internal page rounds itself
    Cut,            // translucent window: cut, repaint at the chrome's tint
    Masked,         // opaque window: hide the square corner under opaque chrome
}

Chosen from whether the backdrop actually installed, not from cfg(target_os).

2. Engine — latest Servo, and the patch is no longer optional

The fork is synced to upstream bd220a152bc0.

The downloads patch is still needed. Upstream at bd220a15 has no embedder
download API under any name; servo/servo#40210 is still open.

It still applies unchanged. Cherry-picked with no conflicts, and the
regenerated diff is byte-identical to the committed one — none of the context
moved. patches/ is untouched.

goddv-patches            929546bf7b1a   (was 36176b7d2c06)
zervo-downloads-f7cd7d8  36176b7d2c06   preserved, pinned by current main
zervo-downloads-a57e1ff  0d5a12189e50   preserved, pinned by v0.4.1

Both older commits were pushed to their own branches and confirmed reachable
before the branch moved, so no release can lose its engine.

The branch is now called goddv-patches rather than zervo-downloads:
it is the place engine patches live, and downloads is only the first one. The
pin is by revision, so nothing depended on the name.

The patch is committed rather than appended. main had stopped building
without it: the 21 August engine bump renamed MouseButton's variants,
src/main.rs follows the new names, and the newest servo on crates.io is
still 0.5.0 with the old ones. A plain cargo build failed with three E0599s
while every workflow stayed green — they all appended the patch, and the one
job that runs on a PR never builds the binary. So .cargo/config.toml carries
it, the four append steps are gone, and the revision lives in one file instead
of four.

⚠️ The part worth reviewing hardest. Moving the pin silently dropped
71 crates from the graph, because upstream has since put webgl and
webcrypto behind cargo features that default-features = false excludes. In
the published 0.5.0 both came for free. Lost were servo-webgl and the entire
crypto stack — aes, rsa, ecdsa, ed25519-dalek, ml-kem, sha3. User
impact would have been window.crypto undefined (so crypto.randomUUID() and
getRandomValues() throwing across much of the web) and
canvas.getContext("webgl") returning null, with nothing naming the browser as
the cause. Both features are now named explicitly; a re-diff of the lockfile
shows 7 crates still absent, all upstream churn Zervo cannot reach — jemalloc
moved behind use-jemalloc, which servo does not re-export.

GStreamer is unchanged and still on by default on macOS and Linux. Windows has
never had a media input at all — a gap, not a regression.

3. Command reports as Meta

winit calls that key Super; the spec and every other browser call it Meta,
so a page testing e.key === "Meta" never saw Command. src/keyboard.rs is a
copy of servoshell's keyutils.rs and predates servo#47330. Diffing the two
tables, it is the only substantive difference.

4. What the bump unlocked

The point of syncing was to be able to wire things, so here they are.

A preferences block

Nine preferences Servo ships off by default. The one that was actually
breaking pages is dom_intersection_observer_enabled: without it
loading="lazy" images never load at all, so any lazy-loading site showed
blank rectangles forever. Alongside it the async clipboard, adopted
stylesheets, container queries, multi-column layout, variable fonts, the visual
viewport, the Permissions API, and WebGL 2.

WebGL 1 is untouched — a canvas asking for webgl still gets it. Verified at
runtime rather than assumed:

PROBE webgl2=YES webgl1=YES IntersectionObserver=YES asyncClipboard=YES
      adoptedStyleSheets=YES containerQueries=YES columns=YES
      visualViewport=YES permissions=YES Notification=YES crypto_subtle=YES

shell_background_color_rgba is set from the resolved palette, so the flash
between navigations is the theme's own background instead of white.

Five delegates that were empty defaults

• notify_status_text_changed — the link target on hover, bottom-left,
  clipped to the content card.
• request_unload — beforeunload, through the existing controls queue.
• request_permission — a prompt naming the host that asked, replacing a
  silent deny.
• evaluate_javascript — plus one honest use: ⌘⇧L fills the saved login
  for the page. docs/PARITY.md claimed there was "no way to write into a
  page's fields", and the Settings copy repeated it to users. Neither was true.
  https only, exact host match, and the values cross as JSON literals rather
  than spliced into source, so a password containing a quote is data and not
  syntax. Only offering to save a login is genuinely blocked — there is no
  embedder hook for a submitted form.
• show_notification — notifications are shown in the window, over the page
  that raised them, and kept behind a bell in the address bar so one you
  missed by six seconds is still there. Toasts grow out of the bell rather than
  appearing beside it: a notification with no visible cause reads as the window
  doing something, not the page. They are made of the same Surface::Menu glass
  as every other floating panel, so a theme that restyles menus restyles these.

Notifications needed a second engine patch — not the obvious one. Servo has
dispatched EmbedderMsg::ShowNotification to the delegate all along, but it
only reaches that call after fetching the notification's image, icon and badge:
show is invoked from the fetch-completion handler, so a notification carrying
none of those queues no requests, nothing ever completes, and it is never
shown at all. Constructed, no error event, silence. Since a plain
title-and-body notification is what most pages raise, the delegate was
unreachable for the common case.

Found by testing by hand — permission granted, and nothing whatsoever appeared.
The fix is that waiting for an empty set of fetches is over immediately.
goddv-patches now carries two patches; the pin moves to 73db5dc4f44c.

There is no system-notification integration: that wants a signed bundle and
UNUserNotificationCenter on macOS. Icons, badges and images are dropped —
each would need uploading as a texture. Both stated in PARITY.md rather than
quietly omitted.

The bell's codepoint was read out of the vendored font rather than guessed. The
font's post table is version 3.0 and carries no glyph names, so the codepoint
came from the Phosphor stylesheet — after confirming that stylesheet agrees with
all sixty-two existing constants in src/phosphor.rs.

Three more bugs on this side, found by review

The engine patch made notifications arrive; an adversarial review of the new
code (four independent lenses, every finding put to separate agents to refute —
11 raised, 9 survived) found what would have greeted them.

• Clicks fell through to the page. The toast Area painted through
  ui.painter() and never grew its min_rect, so egui stored it zero-sized,
  layer_id_at never resolved the pointer to that layer, and
  is_pointer_over_egui stayed false — which is what the event loop consults
  to decide a click belongs to the page. A toast showed a pointing-hand cursor,
  refused to be dismissed, and passed the click through to the page underneath.
  DismissNotification and ClearNotifications were unreachable.
• The morph never ran. animate_bool_with_time(fresh_id, true, _) seeds
  the entry with the target and returns it, so grow was 1.0 on the very first
  frame — every toast snapped to its resting place fully drawn, and egui never
  requested the frames an animation needs. My code comment claimed the
  opposite. Driven by the toast's own age now.
• The bell overflowed the pill during a load. One 24pt trailing slot, taken
  by the spinner, leaving the bell 21pt outside the glass — visible as the bell
  jumping out of the pill and back on every navigation.

Plus one clock reading per frame instead of two straddling the draw pass, and a
test that read ids out of the model and compared them against the same model,
so a positional id passed it. Confirmed by mutation: under id: items.len()
the old test stays green and the new one fails.

Documentation that had drifted

PARITY.md and TODO.md listed devtools, notifications and protocol handlers
as blocked on the engine; all three are delegate methods that exist. Meanwhile
geolocation, camera and microphone really are engine gaps — Servo ships no
Geolocation and no getUserMedia IDL, so those prompts can never appear
however well the permission plumbing works. The lists now say which is which.

Verification

On macOS against 929546bf7b1a: plain cargo check clean where it previously
failed, clippy clean under -D warnings with and without
--features engine-downloads, fmt clean. The patch was round-tripped onto a
pristine bd220a15 — 18 files, 375 insertions, no fuzz.

Tests are now 77: the ten new ones cover the notification model, including
tag replacement restarting the linger clock, a notification lingering out
without being discarded (which is what the bell opens onto), and the wake
deadline being empty once nothing is counting down — the case that would
otherwise spin the idle scheduler forever, which is the same class of bug this
branch already fixed once in the repaint path.

The feature block and the absence of panics were checked by running the binary,
not by reading it.

Notifications are now verified end to end on macOS against the patched engine:
permission prompt, three toasts rendering top-right newest-first, and the bell
in the address pill with its count badge — screenshotted, not inferred. The
grow-out-of-the-bell morph is fixed by construction and reasoned through, but
has not been watched frame by frame.

Not verified on Windows or Linux. No toolchain here and Servo does not
cross-compile. The Windows corner path is reasoned from the blend equation, not
seen. A tagged build is the first real exercise of both.