Mellow platform 0.4.0 dev: MSL rendering with verified GPU readback

Mellow's explicit user-space API now renders a checked MSL vertex/fragment subset through an actual Windows OpenGL driver. RenderShaderJit validates and lowers source to GLSL; RenderObjects owns libraries, functions, reusable pipelines, RGBA8 snapshots and encoders; OpenGLProvider owns an isolated WGL worker/context and requires real fence/readback completion.

Recorded on Intel Graphics driver 32.0.101.6737:

• 1,000 MSL offscreen frames, 3,072,000 independently verified pixels, 16,050 native assertions and 27 negative API checks.
• 120 visible MSL frames, 368,640 verified pixels and 120 successful swap API calls. Physical scanout was not measured.
• Separate GLSL substrate runs: 1,000 offscreen / 120 visible frames.
• Typed frontend: 969 Windows checks and 969 Linux ASan/UBSan checks. Linux object/provider builds and 13 report/pixel corruption controls passed.
• Ordinary C++ MSL render client ran one offscreen and 180 paced visible submissions using a retained pipeline.

The runtime does not receive a pixel oracle. The independent supervisor checks triangle coverage, top-left fragment coordinates and gradient color against actual GPU readback. Narrow subpixel edge ambiguity permits only correct gradient or clear, not arbitrary skipped pixels. Source, binary, report and raw stream hashes are recorded.

This is a bounded explicit Mellow API implementation: one triangle per clearing pass, RGBA8, shared float4 parameters, synchronous completion. Apple Objective-C Metal ABI, general MSL/AIR graphics, texture sampling, GL/CL sharing, native Tahoe GPU execution, WindowServer and full Metal 2/3 remain incomplete. Existing compute evidence is preserved. Mellow.kext 0.4.3 is unchanged; this release does not provide a new accelerated Tahoe kext.

Assets contain the exact committed source, GPU readback evidence and SHA-256 manifest. PNGs encode readback; they are not monitor screenshots. No Apple operating-system image is included. Run Tools/verify-render-evidence.py against the source, optionally with --raw-directory pointing to the extracted evidence archive.

Native macOS execution was unavailable on the Windows-only test host. Hosted GitHub Actions could not previously start because the account has a billing restriction; local build/test results do not claim a hosted CI pass.