Protect selected windows from screen capture

Add capture privacy rules for windows, transient children, overview previews and client cursors, with separate capture rendering and deferred-frame invalidation. Keep detached close snapshots out of captures after clients leave the registry.

Validated with release workspace tests, private compositor/EGL regressions, and an isolated release PipeWire capture test.

compositor/src/handlers/xdg_shell.rs

@@ -34,6 +34,7 @@ impl XdgShellHandler for Ferese {
     }
 
     fn title_changed(&mut self, surface: ToplevelSurface) {
+        self.refresh_capture_privacy();
         if self.windows.refresh_metadata(surface.wl_surface()) {
             self.send_shell_snapshots();
             for output in self.surface_outputs(surface.wl_surface()) {
@@ -43,6 +44,7 @@ impl XdgShellHandler for Ferese {
     }
 
     fn app_id_changed(&mut self, surface: ToplevelSurface) {
+        self.refresh_capture_privacy();
         if self.windows.refresh_metadata(surface.wl_surface()) {
             self.send_shell_snapshots();
             for output in self.surface_outputs(surface.wl_surface()) {
@@ -52,6 +54,7 @@ impl XdgShellHandler for Ferese {
     }
 
     fn parent_changed(&mut self, surface: ToplevelSurface) {
+        self.refresh_capture_privacy();
         let Some(parent) = surface.parent() else {
             return;
         };