Protect selected windows from screen capture

Add capture privacy rules for windows, transient children, overview previews and client cursors, with separate capture rendering and deferred-frame invalidation. Keep detached close snapshots out of captures after clients leave the registry.

Validated with release workspace tests, private compositor/EGL regressions, and an isolated release PipeWire capture test.

compositor/src/ipc.rs

@@ -898,6 +898,10 @@ impl Ferese {
             reject("Window no longer exists".into());
             return;
         };
+        if self.capture_protected(&window) {
+            reject("Window is protected from capture".into());
+            return;
+        }
         let Some(output) = self
             .space
             .outputs()